[gnukeyring-discuss] Re: Why do we store the password (even MD5 encrypted)?

[Chris G. <ch...@ar...>]

On Fri, Mar 04, 2005 at 06:56:52PM +0100, Jochen Hoenicke wrote:
> 
> Lastly not storing the MD5 checksum would not prevent brute force
> attacks that make use of known plaintext.  If you could get my database
> you could try to decrypt the "Sourceforge" record with each password 
> until it decrypts to "hoenicke" in the account field.
> 
But in the general case this method of attack won't be available,
you'd have to know something about the user and/or file to do this.

OK about the other points though, I'd sort of forgotten that keyring
is a two-way utility.  I'd been playing with keyring-link to make a
more acceptable command line tool for extracting information from the
keyring database.  I've posted another message about that.

-- 
Chris Green (ch...@ar...)

    "Never ascribe to malice that which can be explained by incompetence."