271–280 of 665 posts
I don’t understand why the author thought it would take years to find this password, as opposed to something closer to the four days it actually took.
They said an exhaustive 7-bit search would take that long. Edit: That would be 128^8 =~ 72 quadrillion DES hashes.
Earlier quoted context omitted.
Exclam! Generally a good move, perhaps even unexpectedly so. Double exclam, !!, being a brilliant move, especially one with flair like a sacrifice. Triple exclam is reserved for the games of Emory Tate. ;)
Emory Tate must have been extraordinary..?
Earlier quoted context omitted.
I'm conflicted about this. I know I'd be pretty upset if an employer starting talking to me about a plaintext password that's supposed to be hashed. The problem is that they brute forced it and then sent it directly off to HR? Yes, as a sysadmin it's perfectly acceptable to be searching for weak passwords, but reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to do. As an admin you ha…
Yes, creepy sexists need our protection and it's exactly the same thing as playing farmville on the bathroom.
Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…
Even if the guy was creepy, you are an asshole revealing something he thought nobody could ever know. That's the same thing like reading his personal letters or similar.
Jack sets his password to "ImgoingtokillyouKaren". Tyler is talking with Jack in his cube and sees Jack type in the password and goes to HR. Is that an asshole move, in your opinion? Is the violation the reveal of the password or something else?
In my opinion, he has an obligation and responsibility to say something if he thinks someone is in danger or being harassed.
Earlier quoted context omitted.
Yes, creepy sexists need our protection and it's exactly the same thing as playing farmville on the bathroom.
Yes, a person alleged to be a creepy sexist deserves some protection and due process.
I agree with this. Everyone deserves due process.
It sounds in this situation like they got their due process. (HR didn't fire them based on the password report, but rather used diligence and due process to investigate/corroborate and only then terminate them.)
I'm shocked at how well the old hashing stood up; sure, it's totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkable. (Granted, it doesn't sound like they did anything fancy like throwing a hundred cloud instances at it or something; I'm not saying you should use DES today:) )
> I'm shocked at how well the old hashing stood up; sure, it's totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkable It's not because the hash is strong, but the password itself is strong (if the attackers don't know additional information about chess). The sole purpose of using a strong hash or a KDF on password is making low-entropy passphrase harder…
Is this actually true? Note that you don't need the actual password, just a hash collision.
Earlier quoted context omitted.
This is a bad analogy.
Actually, it's a rather perfect analogy. People have some expectations of privacy and it's not normally considered acceptable to violate this. Sometimes this stuff is untried in court or falls into a definite legal grey area and usually the policy is to err on the side of caution and simply assume that if something is commonly expected to be private, then it's private and should be kept so. If we were investigating a…
Earlier quoted context omitted.
I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.
For all its flaws, innocent until proven guilty is still the fairest justice system. Beyond a reasonable doubt is a high standard of proof. Because we use this standard, it is natural for people to look for reasonable doubts when talking about accusations. That is how western society works. And for very good reasons.
Is the implication that non-Western societies don't work that way? Or that somehow it's only Western societies that came up and all of them practice this behavior?
I had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.
Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…
It could have been that you reported to HR a romantic fling between two consenting adults, while they had no intention of their private lives spilling over into the public eye.
Disapprove of your actions, and further disapprove of your schadenfreude at someone's firing