Quantcast
Channel: THWACK: Message List
Viewing all articles
Browse latest Browse all 20598

Re: SolarWinds Password Security

$
0
0

I've referred to the orion account password being hashed, which means we can't decrypt the password.

 

Imagine an algorithm where we separate every character of your password and add them up. Next, we store that result in the database, perform the same task every time you log in, and check for equality. That would mean that we don't actually store the password. Now imagine that the algorithm used (add them up) is cryptographically strong and fine for use in military applications. The only way to fetch your original password is with a rainbow table (where somebody has done that algorithm against common passwords and their variants)... that could yield your original password. Except, that we added some extra data (salt) into the mix which means that the rainbow tables aren't logically usable.

 

On occasion, I have locked myself out of Orion. When that happens, I have used Microsoft SQL Studio to overwrite the two columns relating to password with values from another database's account where I know the password. Does that help?


Viewing all articles
Browse latest Browse all 20598

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>