Ken Thompson's Unix Password • Hacker News Board

Re: Ken Thompson's Unix Password

#241

Post by obelos » Wed, Oct 09, 2019, 5:14 PM UTC

melling wrote: post #23

yjftsjthsd-h wrote: post #5

I'm shocked at how well the old hashing stood up; sure, it's totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkable. (Granted, it doesn't sound like they did anything fancy like throwing a hundred cloud instances at it or something; I'm not saying you should use DES today:) )

30 years ago I cracked everyone’s Unix password on an old Sun computer. It didn’t take long because everyone had a password that was in the dictionary. Needless to say, people were not happy with the messenger.

This must have been a popular pastime in the 90s as I did the same thing for my university's security on their new, centralized student accounts server. This effort was further aided by there being a predictable salt used for the password hashes that indicated which passwords were still set to the (again, predictable) default pattern. They were kind not to kick me out and not fire me as I was both a student and part time employee in their networking services department.

Re: Ken Thompson's Unix Password

#242

Post by hackerbrother » Wed, Oct 09, 2019, 5:14 PM UTC

harshreality wrote: post #225

tbabb wrote: post #196

Earlier quoted context omitted.

I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.

Because if people don't push back against it, what we get is yet another incarnation of the witch trials. Some people evidently want that, because they're "not a witch" themselves. It's really awful that in some/many cases, accusations of rape or sexual assault or sexual harassment or creepiness end up reducing to one person's word against another, when there's no good objective evidence either way. You should doubt…

Yes, and if we don't push back against sexual harassment, what we get is yet another... now

Re: Ken Thompson's Unix Password

#243

Post by jedberg » Wed, Oct 09, 2019, 5:15 PM UTC

Razengan wrote: post #233

JoeAltmaier wrote: post #115

I had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.

Hey that's actually a neat idea! You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters. So people could type in different gobbledegook each time between the characters that matter. To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters. So, if my password is: Any 8 characters, but 2nd character must b…

> How more secure would something like that generally be compared to static passwords?

It's not secure at all. If someone knows the rules of the system, the entropy on that is tiny, because it's basically a 2 letter password with only 6/3 options.

The only security would be from the obscurity of the attacker not knowing the password rules.

Re: Ken Thompson's Unix Password

#244

Post by dlivingston » Wed, Oct 09, 2019, 5:15 PM UTC

jackcodes wrote: post #198

mongol wrote: post #156

Earlier quoted context omitted.

I don't know what to think about this. A password is supposed to be secret so I don't know what a naughty phrase in secret is a violation of? It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.

every 90 days is the god pattern

If I crack one of your passwords (or search your email on haveibeenpwned), and assuming you haven't changed your animal, then cracking any other password you have is trivial and takes at most 12 permutations.

Re: Ken Thompson's Unix Password

#245

Post by privateSFacct » Wed, Oct 09, 2019, 5:16 PM UTC

zackbloom wrote: post #104

tonyedgecombe wrote: post #47

Earlier quoted context omitted.

No good deed goes unpunished.

More specifically, pointing out someone else's stupidity is rarely welcome.

I had both experiences in high school. One situation -> bad result. The other I was made a quasi IT fixer - they put me to work (Novel Netware and other stuff). I would be called out of class to fix things. Since I was naturally super interested in how everything worked together and all the features and the librarians or VP or teachers were not it worked out. At the time I took it reasonably seriously.

In hindsight some teacher must have spoken up for me to come up with the solution when they were trying to come up with an appropriate response.

Re: Ken Thompson's Unix Password

#246

Post by TallGuyShort » Wed, Oct 09, 2019, 5:17 PM UTC

CydeWeys wrote: post #168

TallGuyShort wrote: post #144

Earlier quoted context omitted.

I'm all for the effective strength enforcement and ejecting the creepy guy, but some people do have strong passwords that, a bad idea though it may be, embed something deeply personal to them. Just something to keep in mind before automating the sharing of cracked passwords for otherwise legitimate purposes. I consider my passwords my private information, even if they are no longer secure from a technical standpoint…

You shouldn't be using deeply personal stuff like this for work passwords then. It's very legitimate for a company to want to protect themselves from a massively damaging and costly security/privacy incident by policing against the use of weak passwords.

Just to be clear, I agree, and I think what the person I'm replying to did is totally kosher. But I just think the fact that my password is private should not just be within technical limitations. If you find my password is "hurtmedaddy" I have a reasonable expectation to privacy about that beyond what SHA can and can't protect me from, and I would hope it's not showing up in some weekly report to be shared with IT. A hacker might find it anyway, but certainly my boss certainly shouldn't have to.

edit: And back to technical concerns - someone knowing my password leaves a hard-to-audit window in which I am even less secure. Force-resetting the password in automation instead of revealing it would be better. Sharing it more widely before the problem is fixed increases the risk.

Re: Ken Thompson's Unix Password

#247

Post by homonculus1 » Wed, Oct 09, 2019, 5:19 PM UTC

tbabb wrote: post #196

reedwolf wrote: post #184

Earlier quoted context omitted.

>he was fired for the sexual harassment of a coworker OP is vague on what this guy actually did. Note that they only went to the girl after cracking the password, and she said he was "creepy" towards her. "Creepy" in this context might just mean FWU (flirting while ugly).

I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.

There are no facts in this case available to us, the internet commenters; only 100% framing. In a different framing, the victim is the one who was unfairly fired, perhaps due to fitting in poorly or even malicious claims of misconduct by the harasser. And in this framing you are not only blaming the victim, but also attacking everyone who doesn't.

See how this works? "Believe the victim" is circular reasoning, all it does is calcify your priors. Truth-seeking demands that one must keep an open mind and consider competing interpretations of an event.

Re: Ken Thompson's Unix Password

#248

Post by bryanrasmussen » Wed, Oct 09, 2019, 5:19 PM UTC

That password was pretty long - could be a complete windowing system written in J.

Re: Ken Thompson's Unix Password

#249

Post by mongol » Wed, Oct 09, 2019, 5:22 PM UTC

sterkekoffie wrote: post #231

mongol wrote: post #214

Earlier quoted context omitted.

I have seen many password policies that says that you never should disclose your password. I have never seen a password policy say that it must not be naughty. As for violent or suicidal, I am less sure. I guess I would reason like a doctor, who has a patient's privacy to consider, but when certain lines are crossed he can contact the police if he think there is risk of crime.

Then I think our only difference in opinion is whether making sexually aggressive statements about your coworkers is crossing a line or just "naughty."

The difference is maybe that I don't see a password as a statement. There is no intent to let anyone know it. The only purpose it serves is to be difficult to guess / crack and easy to remember.

Re: Ken Thompson's Unix Password

#250

Post by jedberg » Wed, Oct 09, 2019, 5:23 PM UTC

bcit-cst wrote: post #220

parliament32 wrote: post #197

Earlier quoted context omitted.

I'm conflicted about this. I know I'd be pretty upset if an employer starting talking to me about a plaintext password that's supposed to be hashed. The problem is that they brute forced it and then sent it directly off to HR? Yes, as a sysadmin it's perfectly acceptable to be searching for weak passwords, but reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to do. As an admin you ha…

Yeah that is some NSA shit.

Not really. It was well known that passwords were being cracked, and the guy in question was even warned already that his password had been cracked the week before.