Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

Post reply on HN
Print view View original

51–60 of 665 posts

Re: Ken Thompson's Unix Password

#51

Post by Gunax »

dekhn wrote: post #40

i deduced my dad's password when I was a middle-schooler. The uni micro had a teletype and although it did not echo password characters, if you mistyped your password, it would print the mistyped password, and knowing a bit about my dad, I could figure out what the correct password was. I logged in and sent himself an email reminding him to use a better password.

That's just a bad system design, not your dad's fault really:

"You're password 'huntet2' is invalid"

unless the password is just random characters, anyone can guess how it was mistyped.

Hell, even if it was just random characters, one could just assume that it's one character-off from the real password, and try shifting each character around.

Re: Ken Thompson's Unix Password

#53

Post by gwbas1c »

ryanlol wrote: post #8
carlmr wrote: post #7

>Since the DES-based crypt(3) algorithm used for these hashes is well known to be weak (and limited to at most 8 letters) >ZghOT0eRm4U9s:p/q2-q4! How is that 8 letters?

The part before : is the hash, the part after is the cracked 8 character password.

Honestly, that confused me too. I really thought the whole password was that long.

Re: Ken Thompson's Unix Password

#55

Post by giancarlostoro »

asdfman123 wrote: post #20
giancarlostoro wrote: post #13

Earlier quoted context omitted.

Is your username an ode to this somehow? :) Mr. Asdf sir

Nope, but by an old internet meme: https://knowyourmeme.com/memes/asdfmovie

I forgot all about asdfmovie! That's an oldie for sure.

Re: Ken Thompson's Unix Password

#58

Post by taborj »

dekhn wrote: post #40

i deduced my dad's password when I was a middle-schooler. The uni micro had a teletype and although it did not echo password characters, if you mistyped your password, it would print the mistyped password, and knowing a bit about my dad, I could figure out what the correct password was. I logged in and sent himself an email reminding him to use a better password.

>if you mistyped your password, it would print the mistyped password,

That's incredibly useful. Stand next to someone, casually chatting, while they enter their password. Just before they hit [ENTER], stab a key -- say, a 'z'. Boom, it prints their password with an extra 'z' at the end.

Sure, they'd be aware of it and likely change their password. But still. A more common use case would be to hang around and wait for them to inevitably typo the password. If you see that enough, you'll get a really good idea about what it's supposed to be, or at least give you enough of the password to make figuring out the missing part trivial.

Re: Ken Thompson's Unix Password

#59

Post by magashna »

asdfman123 wrote: post #9
adossi wrote: post #4

Earlier quoted context omitted.

I would have borrowed "/.,/.," a long time ago had I heard about it sooner. That is just way too convenient.

My first password ever was qazwsx and I used it until I learned that it's included in "known" password text files and thus instantly crackable. However, I wonder how safe it is to take an "easy" password like /.,/.,/., and then add a bunch of exclamation points to the end, so that it's both long and not part of a dictionary. I'm sure password crackers are advanced enough to first try taking common passwords and then…

best practices have changed from using a complex password with lots of upper/lower and symbols to use something longer but easier to remember. More strength from misspellings and a few symbols

My Fav0riT Pas%werd

is actually pretty solid compared to

df22@$Fasdf

because the latter is more crackable

Re: Ken Thompson's Unix Password

#60

Post by octosphere »

I use a diceware[0] passphrase for my Keepass database. I was inspired heavily by XKCD comic 936[1]. My only issue with password managers is that they are a single point of failure and are juicy targets for hackers, so I usually vet them and audit them thoroughly before I use them. I am one of those rare people that actually looks at the source code of password managers to look for flaws in the implementation (I sometimes spot flaws and duly report them to the maintainers).

One caveat to diceware I never liked is how it wears out the keyboard over time as you have to type the same passphrase each time to open the vault (You would be surprised how many times I need to do this each day). I sometimes have to lock my database to avoid evil maid attacks when in a hotel for example. Of course I go through about three keyboards a year because of this, but I don't mind the cost if it gives me a crispy fresh keyboard each time. And did I mention I don't own merely one encrypted database, but many depending on different contexts and different devices?

[0] https://en.wikipedia.org/wiki/Diceware

[1] https://www.xkcd.com/936/

Post reply on HN