Ken Thompson's Unix Password • Hacker News Board

Re: Ken Thompson's Unix Password

#281

Post by OJFord » Wed, Oct 09, 2019, 5:51 PM UTC

austincheney wrote: post #270

jackcodes wrote: post #198

Earlier quoted context omitted.

every 90 days is the god pattern

A better pattern is something long that will exceed the bounds of a rainbow table. I love JavaScript but I really wish it didn't have the ASI feature* The example is 67 characters long written in a statement that is easy to remember with two non-alpha characters aside from the spaces. Imagine the size of rainbow table it would take to crack that.

I'm not sure how easy that is to remember... Was it 'really love but wish' or 'love but really wish'? etc.

Re: Ken Thompson's Unix Password

#282

Post by twodave » Wed, Oct 09, 2019, 5:51 PM UTC

saturn_vk wrote: post #88

magashna wrote: post #59

Earlier quoted context omitted.

best practices have changed from using a complex password with lots of upper/lower and symbols to use something longer but easier to remember. More strength from misspellings and a few symbols My Fav0riT Pas%werd is actually pretty solid compared to df22@$Fasdf because the latter is more crackable

I really like the logic behind this one: https://www.xkcd.com/936/ It also doesn't require any special characters and its quite easy to remember.

The only knock on this strategy is that the more people adopt it the less effective it becomes (crackers will just start trying combinations of common words). The up-side is there are more 4-word combinations in English using only the 10,000 most common words than in any 8-character password, so even if crackers targeted the strategy specifically it's more costly to crack.

Re: Ken Thompson's Unix Password

#283

Post by [deleted] » Wed, Oct 09, 2019, 5:52 PM UTC

semi-extrinsic wrote: post #138

maccard wrote: post #132

Earlier quoted context omitted.

They got lucky/narrowed the search space. Just because it will take me 2 years to evaluate all the possibilities, doesn't mean I won't immediately hit aaaaaaaa

Specifically, we can conjecture they narrowed the search space to "lowercase+numbers+a few symbols", excluding uppercase letters.

[deleted]

Re: Ken Thompson's Unix Password

#284

Post by program_whiz » Wed, Oct 09, 2019, 5:54 PM UTC

jedberg wrote: post #250

bcit-cst wrote: post #220

Earlier quoted context omitted.

Yeah that is some NSA shit.

Not really. It was well known that passwords were being cracked, and the guy in question was even warned already that his password had been cracked the week before.

Wait, how is it a common / weak password if it has some oddly sexual phrase regarding a specific person? Sounds like its literally just brute-forcing, in which case you're just going to hit random user's passwords.

Re: Ken Thompson's Unix Password

#285

Post by schappim » Wed, Oct 09, 2019, 5:54 PM UTC

bitwize wrote: post #112

berbec wrote: post #50

Interestingly enough, this password does not show up on haveibeenpwnd!

Probably a dearth of chess passwords in their database. Try haveibeenpawnd.

Brilliant!

Re: Ken Thompson's Unix Password

#286

Post by anchpop » Wed, Oct 09, 2019, 5:55 PM UTC

malloreon wrote: post #193

300bps wrote: post #181

Earlier quoted context omitted.

Not to mention "creepy" is a charge that is often impossible to defend yourself from. It's wholly dependent on the subjectivity of the accuser and their opinion of the accused. Walk over and say good morning every day to a coworker and she finds you attractive? Charming and sweet. Walk over and say good morning every day to a coworker and she finds you unattractive? Creepy.

In this hypothetical example are you walking over and saying good morning to each of your male coworkers as well? The point is, treat your coworkers the same, regardless of gender.

I haven't been in the workforce very long, so I really don't know and am asking genuinely. Is it ever okay to flirt with a coworker?

Re: Ken Thompson's Unix Password

#287

Post by jerf » Wed, Oct 09, 2019, 5:55 PM UTC

Razengan wrote: post #257

jedberg wrote: post #243

Earlier quoted context omitted.

> How more secure would something like that generally be compared to static passwords? It's not secure at all. If someone knows the rules of the system, the entropy on that is tiny, because it's basically a 2 letter password with only 6/3 options. The only security would be from the obscurity of the attacker not knowing the password rules.

> because it's basically a 2 letter password with only 6/3 options. That was obviously an oversimplified example to explain the rules. In practice you could make it as obscure as you want, while keeping it easy for you to remember. Like the sentences I just typed here. No limit on the number of characters. I could enter different long sentences each time, as long as the characters at specific positions match certain…

There is no way that "use a (proper) subset of the characters for bits of entropy" is going to beat "use all the characters for bits of entropy". Almost by definition, the second is going to have more entropy.

You're not getting anywhere, because people trying to guess your password don't have to guess your scheme. All you're doing is making it easier for them. There is no sense in which you are making it harder.

In the optimum case, you'd require them to get the right characters in the slots you're counting, but to not use the wrong characters in the slots you're not counting, thus demonstrating that they actually know the scheme in question and aren't just getting lucky. There would be exactly one character you'd accept in the slot you're counting, and there would be exactly one character they could use to indicate they understand your pattern in the slots you're not counting. This maximizes the chance they have proved to be in possession of your password, rather than just getting lucky because you didn't count their misses. This is, of course, simply using a password normally.

Re: Ken Thompson's Unix Password

#288

Post by GhettoMaestro » Wed, Oct 09, 2019, 5:56 PM UTC

tbabb wrote: post #196

reedwolf wrote: post #184

Earlier quoted context omitted.

>he was fired for the sexual harassment of a coworker OP is vague on what this guy actually did. Note that they only went to the girl after cracking the password, and she said he was "creepy" towards her. "Creepy" in this context might just mean FWU (flirting while ugly).

I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.

Because the evidence is extremely weak and the reason cited for him being axed was he was a "creep"? Pretty subjective in my eyes without other information provided.

There's a mile wide difference between being a weirdo mouth-breathing creep, and actually sexually harassing someone.

Re: Ken Thompson's Unix Password

#289

Post by raldi » Wed, Oct 09, 2019, 5:56 PM UTC

jedberg wrote: post #143

Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…

This is the best password policy there is. The only time I was lucky enough to live under it was for a couple years in college.

Who cares how many uppercase letters I used or the last time I changed it? What matters is how crackable it is. v#ja&zp is better than P@ssword1

Re: Ken Thompson's Unix Password

#290

Post by cestith » Wed, Oct 09, 2019, 5:57 PM UTC

bcatanzaro wrote: post #209

tbabb wrote: post #196

Earlier quoted context omitted.

I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.

For all its flaws, innocent until proven guilty is still the fairest justice system. Beyond a reasonable doubt is a high standard of proof. Because we use this standard, it is natural for people to look for reasonable doubts when talking about accusations. That is how western society works. And for very good reasons.

But where's the innocent until proven guilty for the sysadmin and the woman accused of falsely accusing the guy who was fired?

HR doesn't fire on a whim. I'd default to saying this guy got due process.