Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

Post reply on HN
Print view View original

401–410 of 665 posts

Re: Ken Thompson's Unix Password

#401

Post by asdfman123 »

dmurray wrote: post #395
asdfman123 wrote: post #9

Earlier quoted context omitted.

My first password ever was qazwsx and I used it until I learned that it's included in "known" password text files and thus instantly crackable. However, I wonder how safe it is to take an "easy" password like /.,/.,/., and then add a bunch of exclamation points to the end, so that it's both long and not part of a dictionary. I'm sure password crackers are advanced enough to first try taking common passwords and then…

This article from 2013 shows some impressive password-generating techniques that cracked secure-looking passwords like momof3g8kids. It doesn't specifically give an example like MyDogRules###########!, but it seems reasonable they could get it by similar methods of concatenating multiple password fragments. [0] https://arstechnica.com/information-technology/2013/05/how-c... (OK, the passwords were hashed only with MD…

So I guess what they're saying is if they just use older password technology and they get hacked, you're screwed.

Re: Ken Thompson's Unix Password

#402

Post by passivepinetree »

whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

That's fascinating. Would you mind sharing the full story?

Re: Ken Thompson's Unix Password

#403

Post by qzx_pierri »

whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

righteous

Re: Ken Thompson's Unix Password

#404

Post by comex »

segfaultbuserr wrote: post #293
leni536 wrote: post #276

Earlier quoted context omitted.

> But if the passphrase is already strong (6 random words from the Diceware wordlist), you can use MD5... Is this actually true? Note that you don't need the actual password, just a hash collision.

MD5 is vulnerable to collision attacks, which allows the attacker to control both messages, m and m', and find a case where h(m) == h(m'). But if a hash, h(m), is given, finding m' where h(m) == h(m') is much more difficult, it's known as a second-preimage attack. "Image" basically means "output", "preimage" means "input", "second-preimage attack" means "find another input that has the same output already given here"…

A second-preimage attack is where you want to find m' where h(m) == h(m')... and you know m already. This is not very useful for password hashing; it would give you a second password that would also work to log into the account, but what's the point of that if you already know the first password? The relevant attack for password hashing is a regular preimage attack, where you don't know m (and it would be acceptable to find either m itself or any other string that hashes to the same value).

Re: Ken Thompson's Unix Password

#405

Post by hermitdev »

noir_lord wrote: post #315
melling wrote: post #23

Earlier quoted context omitted.

30 years ago I cracked everyone’s Unix password on an old Sun computer. It didn’t take long because everyone had a password that was in the dictionary. Needless to say, people were not happy with the messenger.

Inherited a system at current (for a few more weeks) employer (recently written so no excuse) that had used a weak hash for the password, I pointed out to my boss how bad it was and that it shouldn't have happened, he didn't pay a great deal of attention. So I threw the OpenMP variant of John the Ripper at it (I'd just built a 8C/16T Ryzen machine and was curious) it broke ~80% of the passwords in under an hour and a…

Reminds me of a security issue we had on our linux servers at a former employer. Short of it is, one could run any command as another non-root user without having sudo access or knowing the user's password. rsh access was inadvertently left wide open on thousands of servers.

A coworker and I stumbled into this one morning when I was helping him figure out how to remotely invoke a linux command from a windows gui. I don't recall why we were using rsh as we'd normally ssh into our servers. As we sat there trying to figure out how to enter the password, we decided to just try and run the command w/o a password. We were shocked when it just worked - we were never prompted for a password. When I reported this to my director, he asked me how bad it was. I was like, watch this: I sent an email as the CEO to him saying "you're fired.". He immediately went to our infrastructure team to get it fixed. Fun times...

Re: Ken Thompson's Unix Password

#406

Post by yaseer »

WBrad wrote: post #359
yaseer wrote: post #253

Earlier quoted context omitted.

I agree, - but morality is sticky and complex. It was obviously wrong to be the creepy sexist. In the abstract sense, it is wrong to invade privacy. But then, if in your invasion of privacy you uncover a wrongdoing, the right thing to do is report it. It would be wrong to read the CFO's email inbox, and probably illegal. But then if you uncover they are committing fraud, you need to report it to police, as well as co…

I get what you're saying here but: >In the abstract sense, it is wrong to invade privacy. You have no real expectation of privacy when using company owned equipment. This was almost certainly spelled out to the employee in question in the acceptable use policy he agreed to upon being hired. Companies have to operate this way so they can investigate computers if compelled to by court or law, and so they can recover im…

You make a compelling point. The key is 'acceptable use'.

Acceptable use is cracking passwords in an investigation with just cause.

Acceptable use is a script to automate the checking of weak passwords, and notify users.

Unacceptable use is an admin browsing cracked passwords, without just cause.

I personally think acting on the information obtained afterwards is acceptable, but some would disagree.

Remember even in some courts, evidence obtained by police illegally cannot be submitted for trial.

I maintain these moral problems are hard ones.

Re: Ken Thompson's Unix Password

#407

Post by psb »

blotter_paper wrote: post #183
taborj wrote: post #58

Earlier quoted context omitted.

>if you mistyped your password, it would print the mistyped password, That's incredibly useful. Stand next to someone, casually chatting, while they enter their password. Just before they hit [ENTER], stab a key -- say, a 'z'. Boom, it prints their password with an extra 'z' at the end. Sure, they'd be aware of it and likely change their password. But still. A more common use case would be to hang around and wait for…

I've never done anything malicious with the knowledge, but I've totally learned people's passwords just by watching their fingers type. I make an effort to have passwords that would be difficult for a human to nail down while watching them typed quickly in real time. The ubiquity of cameras has me reconsidering input and/or authentication mechanisms, though.

One good thing about using dvorak I guess

Re: Ken Thompson's Unix Password

#408

Post by sverige »

technothrasher wrote: post #141
zackbloom wrote: post #104

Earlier quoted context omitted.

More specifically, pointing out someone else's stupidity is rarely welcome.

Many, many years ago when I was in college at the University of Rochester, I found a paper in the computing lab with the root passwords for about twelve machines at Stanford. I emailed them and told them I'd destroyed it but that they should be much more careful. I got yelled at.

Just curious, did you get yelled at because you destroyed the only copy of their password memory aid? ;)

Re: Ken Thompson's Unix Password

#409

Post by stevewodil »

bobwaycott wrote: post #380

I’m slightly confused by the part where the author states a 7-bit search would take 2 years on a modern GPU, and the answer was found in 4 days on a Vega64. Isn’t that a modern GPU? Have I misunderstood here, or was the author’s math incorrect?

It would take two years to generate every hash, but this one happened to be generated earlier than that. It would also be technically possible to guess a Bitcoin address private key on the first guess, but there are 2^160 total possibilities

Re: Ken Thompson's Unix Password

#410

Post by [deleted] »

RandallBrown wrote: post #234
lolc wrote: post #63

This bothers me because I prefer to use slightly embarrassing passphrases. I do that because it creates a secondary incentive not to disclose them.

In college my roommate and I made our wifi password something like a fart joke. Perfectly fine to tell to our close friends, but kinda embarrassing. One day, at the end of the semester, our female neighbor knocked on our door and asked if she could use our wifi since she was moving out the next day and had already canceled her Internet. I would have been happy to share with her, but I couldn't bring myself to tell he…

[deleted]
Post reply on HN