Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

291–300 of 665 posts

Re: Ken Thompson's Unix Password

#291
post #196

Earlier quoted context omitted.

I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.

For all its flaws, innocent until proven guilty is still the fairest justice system. Beyond a reasonable doubt is a high standard of proof. Because we use this standard, it is natural for people to look for reasonable doubts when talking about accusations. That is how western society works. And for very good reasons.

I think there's more to it than that. If you have some time, give this a read: https://www.propublica.org/article/false-rape-accusations-an...

Since it's quite long, I'll summarize. An 18-year-old woman, "Marie", whose had been in foster homes since the age of 6 or 7, reported having been raped. Her two previous foster mothers, both of whom she was still friends with and whom she told about the rape, suspected she was fabricating the report and, after discussing the matter with each other, said so to the police. Despite the significant forensic evidence, the police persuaded her to recant and ultimately charged her with filing a false report. A couple of years later, a serial rapist with a penchant for photographing his victims was caught. Among his effects was a photograph of Marie.

What does this story tell us? First, that even someone who has just been raped may have difficulty relating the event in a coherent and consistent way, and may not seem to be feeling the emotions one would expect of someone to whom that had happened. (The implications for the Brett Kavanaugh affair are obvious.) Second, that even female friends of the victim might be led by such inconsistencies to doubt the veracity of the report — a sobering observation. And third, that the slogan "Believe Women", though it cannot be taken as an absolute, is still important to repeat, because it's still far more likely that a true report will be doubted than that a false one will be believed.

Re: Ken Thompson's Unix Password

#292

Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…

>* One guy actually got fired for his password. He was already being super creepy and making the girl who sat across from him uncomfortable, but she never told anyone. Then we cracked his password, which was a very naughty phrase about the girl who sat across from him. I reported it to HR, who asked the girl, who then said he was creepy, and so they acted swiftly on the reports and got him out of there.*

So, he never did anything specific to call for, but just "was creepy" (which can often mean he was not very pretty and/or awkward socially / in expressing his feelings, as opposed to someone who would assault or anything close). And he had a password (in private) that was lewd or whatever, which he did not intend to share with anybody.

Yeah, let's fire the guy...

Re: Ken Thompson's Unix Password

#293

Earlier quoted context omitted.

> I'm shocked at how well the old hashing stood up; sure, it's totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkable It's not because the hash is strong, but the password itself is strong (if the attackers don't know additional information about chess). The sole purpose of using a strong hash or a KDF on password is making low-entropy passphrase harder…

> But if the passphrase is already strong (6 random words from the Diceware wordlist), you can use MD5... Is this actually true? Note that you don't need the actual password, just a hash collision.

MD5 is vulnerable to collision attacks, which allows the attacker to control both messages, m and m', and find a case where h(m) == h(m').

But if a hash, h(m), is given, finding m' where h(m) == h(m') is much more difficult, it's known as a second-preimage attack. "Image" basically means "output", "preimage" means "input", "second-preimage attack" means "find another input that has the same output already given here".

Wikipedia says a preimage attack against full MD5 still requires 2^123.4 steps (2009), only a theoretical possibility. Second-preimage should be much harder.

I don't know if there are improvements, but it's still extremely difficult. Well, of course it's not to say that you should use MD5.

Re: Ken Thompson's Unix Password

#295

Earlier quoted context omitted.

> I'm shocked at how well the old hashing stood up; sure, it's totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkable It's not because the hash is strong, but the password itself is strong (if the attackers don't know additional information about chess). The sole purpose of using a strong hash or a KDF on password is making low-entropy passphrase harder…

> But if the passphrase is already strong (6 random words from the Diceware wordlist), you can use MD5... Is this actually true? Note that you don't need the actual password, just a hash collision.

It doesn't seem like it should be obviously true to me. If the hash algorithm was rot13 it would be pretty easy to determine the password from the hash regardless of the strength of the password

Re: Ken Thompson's Unix Password

#296

Earlier quoted context omitted.

> How more secure would something like that generally be compared to static passwords? It's not secure at all. If someone knows the rules of the system, the entropy on that is tiny, because it's basically a 2 letter password with only 6/3 options. The only security would be from the obscurity of the attacker not knowing the password rules.

> because it's basically a 2 letter password with only 6/3 options. That was obviously an oversimplified example to explain the rules. In practice you could make it as obscure as you want, while keeping it easy for you to remember. Like the sentences I just typed here. No limit on the number of characters. I could enter different long sentences each time, as long as the characters at specific positions match certain…

> In practice you could make it as obscure as you want,

If only that made it as secure as you want.

https://en.wikipedia.org/wiki/Security_through_obscurity

Re: Ken Thompson's Unix Password

#297

Earlier quoted context omitted.

It's how the courts work, but not society in general. An individual can use whatever standard they wish to form an opinion. Would you insist that we all treat O.J. Simpson as innocent?

> Would you insist that we all treat O.J. Simpson as innocent? The fair way is to withhold judgment (while presuming innocence) when there's a charge against someone but it hasn't been investigated. That's fair whether we're talking about courts or society. Society pronounced its judgment on O.J. after evidence was presented and witnesses testified. The problem comes when people presume guilt based on a charge alone.…

We have a high standard for guilt in court because someone's freedom and perhaps life is on the line. You as a private citizen have a right to make decisions on less than a drawn-out court case and a sequestered jury.

So, in the eyes of the criminal courts, yes, OJ is still innocent. But would you have him babysit your kids based only on a reasonable doubt he's a multiple murderer?

Re: Ken Thompson's Unix Password

#298

Earlier quoted context omitted.

I'm conflicted about this. I know I'd be pretty upset if an employer starting talking to me about a plaintext password that's supposed to be hashed. The problem is that they brute forced it and then sent it directly off to HR? Yes, as a sysadmin it's perfectly acceptable to be searching for weak passwords, but reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to do. As an admin you ha…

Yes, creepy sexists need our protection and it's exactly the same thing as playing farmville on the bathroom.

If people could read your thoughts (or private messages) I'm pretty sure they could find at least 5 things to fire you and/or publicly whip you at a pillory in the central square of your city.

So don't be so arrogant about someone being "creepy" when they are not mentioned as doing anything specific in public...

Post reply on HN