Password protection: the next generation
Tom Rowan, security consultant, Magirus Since the dawn of computing, passwords and access codes have been used to protect access to computer systems. These passwords protect user accounts. Systems ask for a username and password before access is granted. As some user accounts have increased privileges on systems, the security of these accounts is often given more thought than normal user accounts. However, obtaining the password of even a lowly unprivileged account can be used to gain a toehold onto a system. This can provide a potential springboard to escalate privileges and gain administration access.
Tom Rowan
This article will discuss some of the problems associated with this security model. It will cover the storage of passwords, methods used to attempt obtaining them and some of the mechanisms used to protect them from discovery. It will not cover the techniques needed to obtain a password database from a computer system. This subject is too complex, varied and even contentious for discussion here. This article will discuss passwords in general terms that apply equally to all generalpurpose operating systems; some are better at password security and some are worse. The principles are the same regardless.