need a way to set more secure 8character passwords
** "from the bottom of my heart, off the coast of Carolina, after one or two false starts ** Someone, apparently, hacked my email account at Bellsouth last week sometime... We of course have no idea how, since they (Bellsouth's alleged "Techs" ) spent all the timefrom the start, telling me it was a) my email client that was doing the damage ( eating my email ) Of course using their website and looking but not downloading email, they could see it disappearing right off the server! But I wasn't doing it.. I even shut off my computer for a night, and my email clients are all set to only download email when the fetch button it clicked, That way it has no chance of interfering w/ info from Celaria or similar... No lockups or anything else.. Tonight we finally reached a person who had a clue. And he told me my account had been hacked, they even watched someone accessing the email, and further attempting to access it after we changed the password. Unfortunatly they only allow and 8 character pwd.. so it wont take someone very long to get into it again.. esp if they are using a linux computer.. but the whole episode has the smell of a windows kiddie playing w/ toys the power of which he has not the slightest clue. I figure he wont bother trying to hack my email again as he never did manage to get anything interesting.. most of my emails are to and from Suse lists <G> But since I couldn't get any email at all I was unable to unsub.. I seem to recall discussion about a program or paper or something about nonsense passwords that could be remembered ... google has let me down today. I couldn't find the article I'm looking for. If anyone remembers reading such a thing please let me know , send an url if there is one... If anyone has a suggestion for making an 8 character password that is reasonably safe or hard to guess w/o being too hard for me to remember , I welcome such suggestions. Now that we finally have confirmation that Bellsouth was the culprit, I shall finish my transformation to all 9.2 boxes... hehehe Since they kept insisting it was not them but my computers that were causing the problems we stopped the installs.. to be certain . why is it that Windows admins refuse to accept they are the problem, or at least the problem is at their end??It shouldn't have taken over a week to ferret out the culprit. Anyone who looked at the accounts inbox could see email arriving and being deleted. Removed from the server while on the phone w/ me .. And they could watch email that was there just disappearing from the servers... but still they insisted I was doing it. ( so why was I talking to them on the phone ??? The logic escapes me) I can't wait to have 9.2 on this box it's really smooth even for something old and underpowered, once you get past the ncurses install... and as speedy as an old celery can be.. And this is a pretty quick athlon w scsi drives etc. so it should be loverly.. TIA to any and all who attempt to help , I wish you happiness.. and offer extra good karma points to anyone who has an idea. -- j -- nemo me impune lacessit
The Friday 2004-11-05 at 21:15 -0500, jfweber@bellsouth.net wrote:
Someone, apparently, hacked my email account at Bellsouth last week sometime... We of course have no idea how, since they (Bellsouth's alleged "Techs" ) spent all the timefrom the start, telling me it was
... Ough. Probably someone has started doing dictionary attacks on mail addresses scooped elsewere. :-/
If anyone has a suggestion for making an 8 character password that is reasonably safe or hard to guess w/o being too hard for me to remember , I welcome such suggestions.
Good passwords are dificult to remember, used on only one account, and changed periodically.
Now that we finally have confirmation that Bellsouth was the culprit, I shall finish my transformation to all 9.2 boxes... hehehe
Not really the culprit... except by being so thickheaded not to accept the fact of the break in. Measures could be stopping and detecting dictionary attacks, ie, rejecting connecions from addresses repeatedly trying an acount within an interval. And of course, not using plain password logins.
Since they kept insisting it was not them but my computers that were causing the problems we stopped the installs.. to be certain .
why is it that Windows admins refuse to accept they are the problem, or at least the problem is at their end??It shouldn't have taken over a week to ferret out the culprit. Anyone who looked at the accounts inbox
Not really windows admins, but any bad admin over there. Perhaps you did not talk with admins, but with "call center" types. -- Cheers, Carlos Robinson
On Sun, 7 Nov 2004, Carlos E. R. wrote:
If anyone has a suggestion for making an 8 character password that is reasonably safe or hard to guess w/o being too hard for me to remember , I welcome such suggestions.
You could try using a mixture of non-standard characters, ie not just all alphabetic chars, such as: A..Z uppercase 0..9 digits and any other characters the password setting program will accept, such as: !"£$%^&*()_+{}[]~<>?/|\ That should foil any dictionary hacking attempts. I find using an alpha-char mixture quite secure. It would also help if the default length for the password setting program could be made a bit longer, say 12 chars at least. Chat to the admin guys and see if this can be made possible. I keep all my usernames and passwords on a floppy disk, and store that in a secure place, as I would NEVER be able to remember them all! HTH - Keith Roberts
The Manual with SuSE 9.2 Pro explains how to enable Crack with PAM to check for easy-to-crack passwords...
jfweber@bellsouth.net schrieb:
Unfortunatly they only allow and 8 character pwd.. so it wont take someone very long to get into it again.. esp if they are using a linux computer..
You are sure that you're using some kind of secure communication channel for sending your password to the POP3 server, that is APOP or POP3S or something? If not, you don't have to worry much about someone *guessing* your password - they can just sniff it. -thh
participants (5)
-
Carlos E. R.
-
jfweber@bellsouth.net
-
Keith Wilkinson
-
suse@karsites.net
-
Thomas Hochstein