Earlier quoted context omitted.
They got lucky/narrowed the search space. Just because it will take me 2 years to evaluate all the possibilities, doesn't mean I won't immediately hit aaaaaaaa
Specifically, we can conjecture they narrowed the search space to "lowercase+numbers+a few symbols", excluding uppercase letters.
Ken Thompson's Unix Password
261–270 of 665 posts
Re: Ken Thompson's Unix Password
#262Earlier quoted context omitted.
The guy wasn't fired for the password, he was fired for the sexual harassment of a coworker. And nothing you do on a work computer is secret from your employer. It's not a "private diary" if you're using your employer's hardware.
>he was fired for the sexual harassment of a coworker OP is vague on what this guy actually did. Note that they only went to the girl after cracking the password, and she said he was "creepy" towards her. "Creepy" in this context might just mean FWU (flirting while ugly).
That's not "flirting" (even if said guy thought that's what he was doing), it's straight up threatening behavior.
Re: Ken Thompson's Unix Password
#263Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…
I don't know what to think about this. A password is supposed to be secret so I don't know what a naughty phrase in secret is a violation of? It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.
Re: Ken Thompson's Unix Password
#264Earlier quoted context omitted.
I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.
For all its flaws, innocent until proven guilty is still the fairest justice system. Beyond a reasonable doubt is a high standard of proof. Because we use this standard, it is natural for people to look for reasonable doubts when talking about accusations. That is how western society works. And for very good reasons.
Call it a bad cultural fit if you prefer. Someone who cannot navigate the social work environment, and makes others feel uneasy and lowers their moral is not as good an employee as someone who'd have no issue doing so, and makes everyone else motivated and confident.
As an employer, I'd probably quickly try and replace such an employee, with someone who's just as good technically, but also has better social work ethics and collaboration skills.
This is totally fair to me. Being good at your job also involves being good with coworkers and promoting a healthy work environment which boosts everyone's productivity. If you have deficiencies there, try working on it. It'll be good for your career.
Now I know what's going to happen... But what if someone totally fabricated a case against you and brought it up to your employer and now your employer falsely believes that you're a big bully and harasser and that you hurt the work environment and they fire you over that?
And I think that's a bit of a fallacy counter-argument honestly. Some kind of reification fallacy. Yes in the abstract hypothetical, this would be unjust, and you can deduce that it was in fact the accuser who was being unprofessional and fabricating an environment of blackmail. But give us any concrete case, and we can now observe the facts of that case and see if employers did an unreasonable assesement or not. For example, we might see in real cases, there is always more than one complaint made, or there are recorded behaviors like emails, chat logs, naughty passwords, etc. Or there's repeated offense, or there was prior knowledge, etc.
And again, no crime here. An employer for their business sake, might prefer to lean on better be careful rather than sorry. That makes total business sense to me.
Re: Ken Thompson's Unix Password
#265Earlier quoted context omitted.
I'm conflicted about this. I know I'd be pretty upset if an employer starting talking to me about a plaintext password that's supposed to be hashed. The problem is that they brute forced it and then sent it directly off to HR? Yes, as a sysadmin it's perfectly acceptable to be searching for weak passwords, but reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to do. As an admin you ha…
Yes, creepy sexists need our protection and it's exactly the same thing as playing farmville on the bathroom.
Re: Ken Thompson's Unix Password
#266Earlier quoted context omitted.
I'm all for the effective strength enforcement and ejecting the creepy guy, but some people do have strong passwords that, a bad idea though it may be, embed something deeply personal to them. Just something to keep in mind before automating the sharing of cracked passwords for otherwise legitimate purposes. I consider my passwords my private information, even if they are no longer secure from a technical standpoint…
You shouldn't be using deeply personal stuff like this for work passwords then. It's very legitimate for a company to want to protect themselves from a massively damaging and costly security/privacy incident by policing against the use of weak passwords.
And running to HR over perceived creepyness sounds like a dick move.
Re: Ken Thompson's Unix Password
#267Earlier quoted context omitted.
I have seen many password policies that says that you never should disclose your password. I have never seen a password policy say that it must not be naughty. As for violent or suicidal, I am less sure. I guess I would reason like a doctor, who has a patient's privacy to consider, but when certain lines are crossed he can contact the police if he think there is risk of crime.
Then I think our only difference in opinion is whether making sexually aggressive statements about your coworkers is crossing a line or just "naughty."
Otherwise we're getting dangerously close to thoughtcrimes.
Re: Ken Thompson's Unix Password
#268I had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.
Hey that's actually a neat idea! You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters. So people could type in different gobbledegook each time between the characters that matter. To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters. So, if my password is: Any 8 characters, but 2nd character must b…
9A4jc@23
Bam. Access granted.Re: Ken Thompson's Unix Password
#269Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…
Brave!
Re: Ken Thompson's Unix Password
#270Earlier quoted context omitted.
I don't know what to think about this. A password is supposed to be secret so I don't know what a naughty phrase in secret is a violation of? It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.
every 90 days is the god pattern
I love JavaScript but I really wish it didn't have the ASI feature*
The example is 67 characters long written in a statement that is easy to remember with two non-alpha characters aside from the spaces. Imagine the size of rainbow table it would take to crack that.