Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

Post reply on HN
Print view View original

61–70 of 665 posts

Re: Ken Thompson's Unix Password

#61

Post by taborj »

dekhn wrote: post #45
windsurfer wrote: post #10

Earlier quoted context omitted.

The early days of mainframes had some groups of individuals who advocated for no passwords or just your username again as a password: https://www.oreilly.com/openbook/freedom/ch07.html

you're confusing mainframes with UNIX microcomputers, and 1983 wasn't early. Also, I rememebr when FSF hosted UNIX machines at MIT that you could telnet into without a password. It was a total mess.

Cliff Stoll's The Cuckoo's Egg grapples with this a bit. The fine line between open systems that anyone can use, and closed systems that protect your privacy and data.

It's obviously a settled question these days, but back in the 70s and 80s, this was a bit of a hot topic.

Re: Ken Thompson's Unix Password

#62

Post by bitofhope »

asdfman123 wrote: post #9
adossi wrote: post #4

Earlier quoted context omitted.

I would have borrowed "/.,/.," a long time ago had I heard about it sooner. That is just way too convenient.

My first password ever was qazwsx and I used it until I learned that it's included in "known" password text files and thus instantly crackable. However, I wonder how safe it is to take an "easy" password like /.,/.,/., and then add a bunch of exclamation points to the end, so that it's both long and not part of a dictionary. I'm sure password crackers are advanced enough to first try taking common passwords and then…

I remember reading a blog post about how something like "aaaaaaaaaaaaaaaaaaaa…" with sufficient 'a's was actually perfectly secure since it wasn't included in any of the common cracklists or hash leaks. I think the number of 'a's was somewhere in the 30s. Obviously bruteforcing it would take absurdly long, too.*

The problem is, after I've committed a long passphrase into muscle memory, it probably takes me less time to type a 40-character phrase than count 40 individual keypresses of a button hoping I don't miscount.

* Assuming nobody is stupid enough to make a depth-first password cracking program. "I'm down to a billion 'a's now. I should be ready to try a 'b' any minute now!"

Re: Ken Thompson's Unix Password

#65

Post by lucb1e »

rpmisms wrote: post #21

I'm disappointed that it followed a pattern like that, since that's supposed to make it easier to brute-force guess.

Yes, any sort of logic is weaker than random characters. But this was a long long time ago, hence the weak passwords. Computers couldn't crack things that fast. Today, recommendations are still based on what we expect computers will be able to crack in the foreseeable future.

I remember a teacher used the password "music". We had every user's password in plaintext. This was useful when installing a new Windows domain controller and setting all the passwords (about 30 employees in the school) instead or copying hashes or letting them set their own passwords. In hindsight, I find it batshit crazy that some stupid intern (me) walked around the school with a sheet of paper with literally everyone's password on it, logging into people's systems where necessary or potentially forgetting the sheet somewhere. I'm not saying this never happens anywhere in the world anymore, but I do think security mindset changed in the last decades.

Re: Ken Thompson's Unix Password

#66

Post by CrazyStat »

Gunax wrote: post #51
dekhn wrote: post #40

i deduced my dad's password when I was a middle-schooler. The uni micro had a teletype and although it did not echo password characters, if you mistyped your password, it would print the mistyped password, and knowing a bit about my dad, I could figure out what the correct password was. I logged in and sent himself an email reminding him to use a better password.

That's just a bad system design, not your dad's fault really: "You're password 'huntet2' is invalid" unless the password is just random characters, anyone can guess how it was mistyped. Hell, even if it was just random characters, one could just assume that it's one character-off from the real password, and try shifting each character around.

Even better if you can find it mistyped two different ways.

Re: Ken Thompson's Unix Password

#67

Post by jerf »

Gunax wrote: post #51
dekhn wrote: post #40

i deduced my dad's password when I was a middle-schooler. The uni micro had a teletype and although it did not echo password characters, if you mistyped your password, it would print the mistyped password, and knowing a bit about my dad, I could figure out what the correct password was. I logged in and sent himself an email reminding him to use a better password.

That's just a bad system design, not your dad's fault really: "You're password 'huntet2' is invalid" unless the password is just random characters, anyone can guess how it was mistyped. Hell, even if it was just random characters, one could just assume that it's one character-off from the real password, and try shifting each character around.

To be precise, in the case of a patterned password (i.e., dictionary word or something a human can recognize), it leaks all but about 2-3 bits, assuming the human can work out the most likely mistake as in your example, and we assume it's a simple error like a nearby key or simple character flip.

If it's a random password, it may still leave 2-3 bits per character as it becomes much harder to know where the error is (e.g., if "j9^vl4JO" is wrong, what is the correct password?), but if you have your hands on two independent errors, which is reasonably likely, that pretty much collapses to 1-2 bits tops even in the random case (e.g., if you also have "k9^vl4JP" that pretty much nails it down to either the first and last being "j P" or "k O").

It is a truly terrible idea!

Re: Ken Thompson's Unix Password

#69

Post by School-Cotton »

newen wrote: post #48
CrazyStat wrote: post #16

Earlier quoted context omitted.

It is the beginning of the closed game, which is what the article says. Seems like a vacuous nitpick.

Not if you play chess. 1. d4 is played probably more than half the time in professional games. It can lead to lots of different openings, closed and open (but not at the same time).

Really? I though 1. e4 was more common. TIL!
Post reply on HN