Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

Post reply on HN
Print view View original

311–320 of 665 posts

Re: Ken Thompson's Unix Password

#311

Post by kelnos »

1000units wrote: post #305
jedberg wrote: post #250

Earlier quoted context omitted.

Not really. It was well known that passwords were being cracked, and the guy in question was even warned already that his password had been cracked the week before.

Much "NSA shit" is also well known. The questionable behavior in this case is getting a guy fired for selecting a politically-incorrect secret passphrase . This is merely one step removed from reading his brain and figuring out he fantasizes about spanking coworkers while having sex with them. (I've done this, and yet we are good friends!) We don't know all the details, maybe that guy actually harassed people, but sc…

> The questionable behavior in this case is getting a guy fired for selecting a politically-incorrect secret passphrase.

I think you're being disingenuous. The guy got fired for sexual harassment. The password merely tipped people off as to what was going on. Don't use a weasel word like "politically incorrect" to re-frame the discussion in a way that's both incorrect and more favorable to an emotional reaction in your favor.

Re: Ken Thompson's Unix Password

#312

Post by fwip »

anchpop wrote: post #295
leni536 wrote: post #276

Earlier quoted context omitted.

> But if the passphrase is already strong (6 random words from the Diceware wordlist), you can use MD5... Is this actually true? Note that you don't need the actual password, just a hash collision.

It doesn't seem like it should be obviously true to me. If the hash algorithm was rot13 it would be pretty easy to determine the password from the hash regardless of the strength of the password

Yep, you need both the input and hash to be strong.

A weak hash reveals information about its input, narrowing the search space. In the example case of md5 or rot13, you can use this to compute collisions for a given hash.

Also, a hash that is lightning-quick to compute is faster to brute force. That's why bcrypt has a tunable "cost" factor - to make the hashing take longer and make guessing the password slower.

Re: Ken Thompson's Unix Password

#313

Post by kbutler »

apta wrote: post #278
bcatanzaro wrote: post #209

Earlier quoted context omitted.

For all its flaws, innocent until proven guilty is still the fairest justice system. Beyond a reasonable doubt is a high standard of proof. Because we use this standard, it is natural for people to look for reasonable doubts when talking about accusations. That is how western society works. And for very good reasons.

> That is how western society works. And for very good reasons. Is the implication that non-Western societies don't work that way? Or that somehow it's only Western societies that came up and all of them practice this behavior?

Actually, yes. (Hopefully you were asking rather than woke-scolding).

Presumption of innocence traces back to roman law (hence "occidental" from the latin, meaning the going down/setting of the sun, or "western", referring to European countries) . It has propagated at various rates through various cultures. Other cultures (including germanic, which could also be classified as "western") did not have the presumption of innocence centuries ago. China (latin "oriental", rising sun, or eastern) has been moving toward it in the last 50 years.

This doesn't say that no other culture has independently developed the presumption of innocence principle, but that the idea of it in modern judicial systems around the world traces back to the roman culture, and is generally associated with a body of ideas collectively called "western culture".

See https://en.wikipedia.org/wiki/Presumption_of_innocence

https://www.researchgate.net/publication/326070104_Understan...

Re: Ken Thompson's Unix Password

#314

Post by dkonofalski »

Razengan wrote: post #257
jedberg wrote: post #243

Earlier quoted context omitted.

> How more secure would something like that generally be compared to static passwords? It's not secure at all. If someone knows the rules of the system, the entropy on that is tiny, because it's basically a 2 letter password with only 6/3 options. The only security would be from the obscurity of the attacker not knowing the password rules.

> because it's basically a 2 letter password with only 6/3 options. That was obviously an oversimplified example to explain the rules. In practice you could make it as obscure as you want, while keeping it easy for you to remember. Like the sentences I just typed here. No limit on the number of characters. I could enter different long sentences each time, as long as the characters at specific positions match certain…

That's just the same thing as a password, though. Even a short password is still just ensuring that specific characters are in specific positions. The only situation where this would be useful is against people with physical or viewable access to the password being typed.

Re: Ken Thompson's Unix Password

#315

Post by noir_lord »

melling wrote: post #23
yjftsjthsd-h wrote: post #5

I'm shocked at how well the old hashing stood up; sure, it's totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkable. (Granted, it doesn't sound like they did anything fancy like throwing a hundred cloud instances at it or something; I'm not saying you should use DES today:) )

30 years ago I cracked everyone’s Unix password on an old Sun computer. It didn’t take long because everyone had a password that was in the dictionary. Needless to say, people were not happy with the messenger.

Inherited a system at current (for a few more weeks) employer (recently written so no excuse) that had used a weak hash for the password, I pointed out to my boss how bad it was and that it shouldn't have happened, he didn't pay a great deal of attention.

So I threw the OpenMP variant of John the Ripper at it (I'd just built a 8C/16T Ryzen machine and was curious) it broke ~80% of the passwords in under an hour and all of them over an afternoon of not been in use.

Went to see the boss and gave him the list of passwords including his (which was one of the weaker ones) - he gave me the time to fix it and some other glaring security issues.

The more things change the more they stay the same.

I know enough about security to know that I really don't know about security.

Re: Ken Thompson's Unix Password

#316

Post by saagarjha »

mywittyname wrote: post #268
Razengan wrote: post #233

Earlier quoted context omitted.

Hey that's actually a neat idea! You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters. So people could type in different gobbledegook each time between the characters that matter. To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters. So, if my password is: Any 8 characters, but 2nd character must b…

If I had a key logger on your system, I'd just try; 9A4jc@23 Bam. Access granted.

If you had a keylogger, it wouldn't really matter how good your authentication scheme is…

Re: Ken Thompson's Unix Password

#317

Post by adrianmonk »

parliament32 wrote: post #197
jedberg wrote: post #143

Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…

I'm conflicted about this. I know I'd be pretty upset if an employer starting talking to me about a plaintext password that's supposed to be hashed. The problem is that they brute forced it and then sent it directly off to HR? Yes, as a sysadmin it's perfectly acceptable to be searching for weak passwords, but reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to do. As an admin you ha…

Former sysadmin here. I think there's a careful balance that needs to be struck, both by admins and users.

As a user, you should realize that when you're on company equipment, privacy is more of a courtesy than a right. It's their equipment you're using. It's reasonable to expect them to use it in a way that furthers the company's interests. So act accordingly.

As an admin, you don't ever go digging through stuff for no reason, for curiosity, voyeurism, or for personal reasons. But again, watching out for the company's interests is part of your job, so if you run across something or have a concrete need to actively look for something (not just a fishing expedition), then lifting the veil of privacy might be the right choice or even the only right choice.

Basically, in a corporate computing environment, privacy is not guaranteed, but crossing lines should have a proper justification. In your CFO example, the sysadmin is using official powers but acting in their own interest, so that's definitely not an OK justification.

Re: Ken Thompson's Unix Password

#318

Post by kelnos »

bcatanzaro wrote: post #209
tbabb wrote: post #196

Earlier quoted context omitted.

I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.

For all its flaws, innocent until proven guilty is still the fairest justice system. Beyond a reasonable doubt is a high standard of proof. Because we use this standard, it is natural for people to look for reasonable doubts when talking about accusations. That is how western society works. And for very good reasons.

That's not how employment works, and (for better or worse) that's not how the court of public opinion works.

"Innocent until proven guilty" and "beyond a reasonable doubt" are critically important for a government-run judicial system, because they ultimately have control over your freedom, life, and death. While a job is certainly important, the loss of one job will not ruin your life unless you are particularly unlucky. So the burden of proof is much less.

Regardless of all that, it's just really saddening to me that the default seems to be that people assume that the victim is lying or overstating the harm done to them. This seems to be something very specific to sexual harassment cases that doesn't crop up as much or as universally with other accusations of wrongdoing. We clearly have a long way to go before we get rid of our knee-jerk biases about this sort of thing (and I'm no exception; I have them too).

Re: Ken Thompson's Unix Password

#320

Post by noir_lord »

privateSFacct wrote: post #245
zackbloom wrote: post #104

Earlier quoted context omitted.

More specifically, pointing out someone else's stupidity is rarely welcome.

I had both experiences in high school. One situation -> bad result. The other I was made a quasi IT fixer - they put me to work (Novel Netware and other stuff). I would be called out of class to fix things. Since I was naturally super interested in how everything worked together and all the features and the librarians or VP or teachers were not it worked out. At the time I took it reasonably seriously. In hindsight s…

Novell Netware - blast from the past.

I had to go apologise to IT (who could barely keep a straight face) at college for sending a message from 'God' saying "I saw what you did last night and it disgusted me".

I thought it was going to just the lab but since I was poking around in something I really didn't understand I manage to send it out site wide.

Fortunately they saw the funny side.

Post reply on HN