[wp-hackers] Rethinking check_admin_referer()

[Brian Layman]

Brian, speaking with his foot in his mouth, said
>>echo "omg! the db password is $word !!!";
>Now stop that! My wife is asking me why I'm laughing!

I'm sorry Sam, I guess I only glanced at that post. 

I thought you were saying the password really must actually be "dollar
sign" Word. (Well it seemed funny at the time.)

I didn't realize you were asking a serious question.  OK, foot out of my
mouth, I can say, yes that is possible to do on a simple hash as you've
described it.  

HOWEVER, there are several very difficult things to overcome with Owen's
proposal that aren't covered in your example.

The first thing is that Owen encrypts using both the DB password AND the
current user password.  So you'd have to go through the dictionary once
for every word in your dictionary.
There's a good chance you'd have to do it in upper lower or mixed case.
The biggest factor is that the DB password is quite often assigned to
the user by the automated tool for creating the DB.  That means the
password will not be a word. 

Thus the whole thing is pretty impossible.