Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

261–270 of 665 posts

Re: Ken Thompson's Unix Password

#261

Earlier quoted context omitted.

They got lucky/narrowed the search space. Just because it will take me 2 years to evaluate all the possibilities, doesn't mean I won't immediately hit aaaaaaaa

Specifically, we can conjecture they narrowed the search space to "lowercase+numbers+a few symbols", excluding uppercase letters.

I guess that cracking this specific password could be said to have been parallelized over multiple individuals over the years, and it wouldn't surprise me if it had burnt multiple years of processor time. In the end, someone had to get lucky when picking their search space/exploration parameters :-)

Re: Ken Thompson's Unix Password

#262

Earlier quoted context omitted.

The guy wasn't fired for the password, he was fired for the sexual harassment of a coworker. And nothing you do on a work computer is secret from your employer. It's not a "private diary" if you're using your employer's hardware.

>he was fired for the sexual harassment of a coworker OP is vague on what this guy actually did. Note that they only went to the girl after cracking the password, and she said he was "creepy" towards her. "Creepy" in this context might just mean FWU (flirting while ugly).

Creepy means they make another person feel threatened. It's certainly not a term most women would use lightly. For example, my sister's "creepy" neighbor would come out of his apartment anytime she came home by herself and would engage her in conversation while attempting to follow her into her apartment.

That's not "flirting" (even if said guy thought that's what he was doing), it's straight up threatening behavior.

Re: Ken Thompson's Unix Password

#263
post #156

Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…

I don't know what to think about this. A password is supposed to be secret so I don't know what a naughty phrase in secret is a violation of? It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.

It's basically thoughtcrime.

Re: Ken Thompson's Unix Password

#264
post #196

Earlier quoted context omitted.

I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.

For all its flaws, innocent until proven guilty is still the fairest justice system. Beyond a reasonable doubt is a high standard of proof. Because we use this standard, it is natural for people to look for reasonable doubts when talking about accusations. That is how western society works. And for very good reasons.

I agree with you, but there is no crime here, just bad work conduct, and as a professional, that makes you not as good at your job, and as an employer, it can justify letting you go.

Call it a bad cultural fit if you prefer. Someone who cannot navigate the social work environment, and makes others feel uneasy and lowers their moral is not as good an employee as someone who'd have no issue doing so, and makes everyone else motivated and confident.

As an employer, I'd probably quickly try and replace such an employee, with someone who's just as good technically, but also has better social work ethics and collaboration skills.

This is totally fair to me. Being good at your job also involves being good with coworkers and promoting a healthy work environment which boosts everyone's productivity. If you have deficiencies there, try working on it. It'll be good for your career.

Now I know what's going to happen... But what if someone totally fabricated a case against you and brought it up to your employer and now your employer falsely believes that you're a big bully and harasser and that you hurt the work environment and they fire you over that?

And I think that's a bit of a fallacy counter-argument honestly. Some kind of reification fallacy. Yes in the abstract hypothetical, this would be unjust, and you can deduce that it was in fact the accuser who was being unprofessional and fabricating an environment of blackmail. But give us any concrete case, and we can now observe the facts of that case and see if employers did an unreasonable assesement or not. For example, we might see in real cases, there is always more than one complaint made, or there are recorded behaviors like emails, chat logs, naughty passwords, etc. Or there's repeated offense, or there was prior knowledge, etc.

And again, no crime here. An employer for their business sake, might prefer to lean on better be careful rather than sorry. That makes total business sense to me.

Re: Ken Thompson's Unix Password

#265

Earlier quoted context omitted.

I'm conflicted about this. I know I'd be pretty upset if an employer starting talking to me about a plaintext password that's supposed to be hashed. The problem is that they brute forced it and then sent it directly off to HR? Yes, as a sysadmin it's perfectly acceptable to be searching for weak passwords, but reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to do. As an admin you ha…

Yes, creepy sexists need our protection and it's exactly the same thing as playing farmville on the bathroom.

Yes, a person alleged to be a creepy sexist deserves some protection and due process.

Re: Ken Thompson's Unix Password

#266

Earlier quoted context omitted.

I'm all for the effective strength enforcement and ejecting the creepy guy, but some people do have strong passwords that, a bad idea though it may be, embed something deeply personal to them. Just something to keep in mind before automating the sharing of cracked passwords for otherwise legitimate purposes. I consider my passwords my private information, even if they are no longer secure from a technical standpoint…

You shouldn't be using deeply personal stuff like this for work passwords then. It's very legitimate for a company to want to protect themselves from a massively damaging and costly security/privacy incident by policing against the use of weak passwords.

I am of two minds about, if it helps security, it sounds somewhat reasonable,but I used questionable passwords in the past partly because they were easy to memorize along the lines of missslippyfist and some numbers/chars. I was forced to stop once company I used to work for started filtering for curses.

And running to HR over perceived creepyness sounds like a dick move.

Re: Ken Thompson's Unix Password

#267
post #214

Earlier quoted context omitted.

I have seen many password policies that says that you never should disclose your password. I have never seen a password policy say that it must not be naughty. As for violent or suicidal, I am less sure. I guess I would reason like a doctor, who has a patient's privacy to consider, but when certain lines are crossed he can contact the police if he think there is risk of crime.

Then I think our only difference in opinion is whether making sexually aggressive statements about your coworkers is crossing a line or just "naughty."

It depends on whether the statement is public or private.

Otherwise we're getting dangerously close to thoughtcrimes.

Re: Ken Thompson's Unix Password

#268

I had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.

Hey that's actually a neat idea! You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters. So people could type in different gobbledegook each time between the characters that matter. To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters. So, if my password is: Any 8 characters, but 2nd character must b…

If I had a key logger on your system, I'd just try;

    9A4jc@23
Bam. Access granted.

Re: Ken Thompson's Unix Password

#269

Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…

I'm excited for your coming adventures, in which our intrepid hero breaks into people's diaries and then tells their friends about the naughty things they wrote.

Brave!

Re: Ken Thompson's Unix Password

#270
post #156

Earlier quoted context omitted.

I don't know what to think about this. A password is supposed to be secret so I don't know what a naughty phrase in secret is a violation of? It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.

every 90 days is the god pattern

A better pattern is something long that will exceed the bounds of a rainbow table.

    I love JavaScript but I really wish it didn't have the ASI feature*
The example is 67 characters long written in a statement that is easy to remember with two non-alpha characters aside from the spaces. Imagine the size of rainbow table it would take to crack that.
Post reply on HN