Re: Algorithmically derived passwords

[Johannes Schwabe <schwabe @ rzaix530 . rz . uni-leipzig . de>]

On Fri, 24 Oct 1997 sedwards @
 sedwards .
 com wrote:

> One of my clients gives all of their hosts root passwords like:
> 
> 	first-letter-of-host-name + (last-digit-of-host-name * 3) % 10\
> 		+ "^" + 3-somewhat-random-letters
> 

It would maybe even be better to leave the root account passwordless,
this achieves about the same effect with much less hassle.

You have to assume that the attacker knows the "formula". He can go
ahead and try out all possible passwords.

Fish. Shoot. Barrel.