Ken Thompson's Unix Password • Hacker News Board

Re: Ken Thompson's Unix Password

#131

Post by jerf » Wed, Oct 09, 2019, 3:35 PM UTC

xoa wrote: post #97

jerf wrote: post #67

Earlier quoted context omitted.

To be precise, in the case of a patterned password (i.e., dictionary word or something a human can recognize), it leaks all but about 2-3 bits, assuming the human can work out the most likely mistake as in your example, and we assume it's a simple error like a nearby key or simple character flip. If it's a random password, it may still leave 2-3 bits per character as it becomes much harder to know where the error is…

> e.g., if "j9^vl4JO" is wrong, what is the correct password? Shouldn't that remain utterly trivial to brute though? If we're assuming all the standard face keys+shifted, I think that's 94 characters. If it's fully unknown then search space is 94^8 or about 6E15, not good but if it's an adaptive hash sizable. But if it's only a one character error, wouldn't you just brute through each of the 8 one by one with only 94…

Yes. I'm just demonstrating with an example that a less structured password is less damaged. It is still something I'd consider "burned" in real life, though.

Re: Ken Thompson's Unix Password

#132

Post by maccard » Wed, Oct 09, 2019, 3:35 PM UTC

abalone wrote: post #125

How did they crack it in 4 days if ”a 7-bit exhaustive search would still take over 2 years on a modern GPU”? Is that overstating it?

They got lucky/narrowed the search space. Just because it will take me 2 years to evaluate all the possibilities, doesn't mean I won't immediately hit aaaaaaaa

Re: Ken Thompson's Unix Password

#133

Post by lolc » Wed, Oct 09, 2019, 3:37 PM UTC

elisto wrote: post #91

lolc wrote: post #63

This bothers me because I prefer to use slightly embarrassing passphrases. I do that because it creates a secondary incentive not to disclose them.

Does that mean that it is embarrassing and can be tied to you or that it is just embarrassing to say? If the first, then wouldn't you risk being pwned and having that used against you?

Oh no not that embarrassing. I don't record private secrets into my passwords. They're more like "I never told Cindy I loved her." with Cindy being a now-dead cat. My embarrassment threshold is low :-)

Re: Ken Thompson's Unix Password

#134

Post by dev_dull » Wed, Oct 09, 2019, 3:37 PM UTC

JoeAltmaier wrote: post #115

I had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.

Such a funny idea. I’d would have loved to see people’s faces when you typed it in.

Re: Ken Thompson's Unix Password

#135

Post by anonymfus » Wed, Oct 09, 2019, 3:38 PM UTC

elwell wrote: post #19

windsurfer wrote: post #10

Earlier quoted context omitted.

The early days of mainframes had some groups of individuals who advocated for no passwords or just your username again as a password: https://www.oreilly.com/openbook/freedom/ch07.html

In the future, there won't be any need for passwords.

In the future there will be no identity theft because we all will have one identity. Resistance is futile...

Re: Ken Thompson's Unix Password

#136

Post by oefrha » Wed, Oct 09, 2019, 3:39 PM UTC

alpb wrote: post #15

Ken Thompson: > congrats. https://inbox.vuxu.org/tuhs/CAG=a+rj8VcXjS-ftaj8P2_duLFSUpmN...

Ken Thompson is a top poster. Busted.

Re: Ken Thompson's Unix Password

#137

Post by sfink » Wed, Oct 09, 2019, 3:41 PM UTC

taborj wrote: post #61

dekhn wrote: post #45

Earlier quoted context omitted.

you're confusing mainframes with UNIX microcomputers, and 1983 wasn't early. Also, I rememebr when FSF hosted UNIX machines at MIT that you could telnet into without a password. It was a total mess.

Cliff Stoll's The Cuckoo's Egg grapples with this a bit. The fine line between open systems that anyone can use, and closed systems that protect your privacy and data. It's obviously a settled question these days, but back in the 70s and 80s, this was a bit of a hot topic.

I disagree. I don't think this is at all settled, and in fact is a bit topic right now. The debate has just moved on past personal passwords.

For example, chat systems. Do you want an open one where anyone can get on with a minimum of fuss and participate? Or do you want an open one, with controls to manage spam and harassment so that people are able to be open while using it?

(I work at Mozilla, where we are moving off of IRC because, while it encourages participation from any rando who comes by, it is inaccessible to a number of people because they will be attacked if they log in. Many have moved over to Slack, which is very much closed (but open). Not to mention the channels that have been abandoned because they are overrun with spam, which makes them inaccessible or at least useless to everyone. As someone who does not get harassed, I don't really like either of those points on the spectrum even though IRC works great for me if I don't think about the people who are no longer there.)

Re: Ken Thompson's Unix Password

#138

Post by semi-extrinsic » Wed, Oct 09, 2019, 3:43 PM UTC

maccard wrote: post #132

abalone wrote: post #125

How did they crack it in 4 days if ”a 7-bit exhaustive search would still take over 2 years on a modern GPU”? Is that overstating it?

They got lucky/narrowed the search space. Just because it will take me 2 years to evaluate all the possibilities, doesn't mean I won't immediately hit aaaaaaaa

Specifically, we can conjecture they narrowed the search space to "lowercase+numbers+a few symbols", excluding uppercase letters.

Re: Ken Thompson's Unix Password

#139

Post by lucb1e » Wed, Oct 09, 2019, 3:44 PM UTC

tom_mellior wrote: post #95

lucb1e wrote: post #65

Earlier quoted context omitted.

Yes, any sort of logic is weaker than random characters. But this was a long long time ago, hence the weak passwords. Computers couldn't crack things that fast. Today, recommendations are still based on what we expect computers will be able to crack in the foreseeable future. I remember a teacher used the password "music". We had every user's password in plaintext. This was useful when installing a new Windows domain…

On the other hand, being admin on a system is not that different. Sure, you don't have users' passwords, but you can still do arbitrary stuff in their name. Very large organizations will have some sort of system that logs this stuff and that you can't tamper with, but in a lot of places you could easily cover your tracks.

I would argue that having passwords made up by users and having access to a user's work account is a little different. In the former case, I see what kind of password they use and can guess that they reuse the password (or a variant) elsewhere. I can also take knowledge if I get fired, but my admin permissions are revoked.

Re: Ken Thompson's Unix Password

#140

Post by CDSlice » Wed, Oct 09, 2019, 3:45 PM UTC

floatingatoll wrote: post #101

frou_dh wrote: post #84

He would have had to expend quite some calories to type that out every time on an ancient keyboard with chunky keys and massive travel.

Uphill! Both ways! How many fewer calories do I burn when typing on a low-travel keyboard rather than an old mainframe keyboard?

Probably not very many. According to XKCD What If? [1] a modern keyboard takes around 2 millijoules to press a key. Typing a full novel would take a few kilojoules. Even if an old mainframe keyboard took 10x more power to press the keys you would save less than a AA battery worth of energy over writing a full novel.

[1] https://what-if.xkcd.com/102/