Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

411–420 of 665 posts

Re: Ken Thompson's Unix Password

#411
post #333
post #15

Ken Thompson: > congrats. https://inbox.vuxu.org/tuhs/CAG=a+rj8VcXjS-ftaj8P2_duLFSUpmN...

Offtopic. Many teams use mailing lists. That UX always scared me. Is anybody know good tutorials on how to getting started to use this kind of interfaces?

You can use Google Groups as either a mailing list or via the web. It's pretty handy and easy to administer if you don't mind outsourcing that to Google.

Re: Ken Thompson's Unix Password

#412

If anyone is curious, the equivalent in modern notation is “1. d4!”. Moving the pawn in front of the queen forward by two spaces. The exclamation point indicates that the annotater believes it to be a particularly strong move (describing a standard move from opening theory that way is a bit tongue-in-cheek).

Yes. The smugness in the exclamation mark is quite funny in a way that keeps me grinning for way too long. It's a bit like a three-year-old declaring "I've got shoes on!"

Re: Ken Thompson's Unix Password

#413
post #333

Earlier quoted context omitted.

Offtopic. Many teams use mailing lists. That UX always scared me. Is anybody know good tutorials on how to getting started to use this kind of interfaces?

This is a common refrain, mailing lists do need a lot of instructions at the bottom to make sense — email wasn't made for groups. It's like 'group' SMS, your phone might provide you with a single chat window with all your friends, but what it really is doing is just sending a separate SMS to every one of the recipients. So you need the 'the manual' attached to every message to make sure people get it right. Looks dow…

> email wasn't made for groups

I've always wondered why people didn't use newsgroups instead of mailing lists.

Re: Ken Thompson's Unix Password

#414

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

Did the same thing with cain & abel. Took 2 days to crack an admin password, it was "weebles". Didn't get expelled though.

Re: Ken Thompson's Unix Password

#415
post #346

Did anyone bother to ask Ken’s permission first before publishing his password on the public internet? Based on his reaction he clearly didn’t mind, but still!

In my opinion this was a pretty crappy thing to do. Password could contain personal and potentially embarrassing information, even if that wasn't the case here.

Revealing people's internet pawn habits shouldn't be done lightly ... /dadjoke

Re: Ken Thompson's Unix Password

#416

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

Dang, well done.

I spent three solid semesters wasting my "Computer Science" electives on breaking into the Novell system... I found tons of these encrypted passwords, and it never occurred to me to just crack one. I did find plenty of other ways to get in, though :)

Re: Ken Thompson's Unix Password

#417
post #235

Earlier quoted context omitted.

Doubt it. It took 4 days for just one top of the line GPU. Any dedicated attacker will have farms to parallelize it even further. It’s not exactly linear, but with just 4 GPUs (~$4000; well within the reach of any dedicated attacker), that’s one day. Not to mention the fact that GPUs have still been roughly following Moore’s Law in terms of performance. It’s probably safe from the casual attacker who just downloads a…

> If I can crack a DES password in 4 days, I can crack a 3DES password in 12 It's multiplicative, not additive. 3DES is about 2^56 times as difficult to crack as DES. (Not 2^112 times because there is an attack that effectively limits it to twice the effective bits of DES, rather than the three times you might expect at first).

This is mostly irrelevant in the context of password hashing however. We're simply feeding passwords into a blackbox at X/s until we get a match. 3DES runs at approximately X/3 compared to DES. If it takes 4 days to feed a bajillion passwords into DES, it takes 12 days to feed the same number into 3DES.

Re: Ken Thompson's Unix Password

#418

Earlier quoted context omitted.

> Would you insist that we all treat O.J. Simpson as innocent? The fair way is to withhold judgment (while presuming innocence) when there's a charge against someone but it hasn't been investigated. That's fair whether we're talking about courts or society. Society pronounced its judgment on O.J. after evidence was presented and witnesses testified. The problem comes when people presume guilt based on a charge alone.…

We have a high standard for guilt in court because someone's freedom and perhaps life is on the line. You as a private citizen have a right to make decisions on less than a drawn-out court case and a sequestered jury. So, in the eyes of the criminal courts, yes, OJ is still innocent. But would you have him babysit your kids based only on a reasonable doubt he's a multiple murderer?

> You as a private citizen have a right to make decisions on less than a drawn-out court case and a sequestered jury.

That's true, but it doesn't make my opinions morally justified.

But my point wasn’t about the verdict--the court’s, mine, or the public’s. It was that it is wrong to presume guilt anywhere—in court or in personal opinion—on the basis of a charge alone. (In OJ's case, we're all far past that, so I think bringing it up is a bit moot.)

Re: Ken Thompson's Unix Password

#419
post #413

Earlier quoted context omitted.

This is a common refrain, mailing lists do need a lot of instructions at the bottom to make sense — email wasn't made for groups. It's like 'group' SMS, your phone might provide you with a single chat window with all your friends, but what it really is doing is just sending a separate SMS to every one of the recipients. So you need the 'the manual' attached to every message to make sure people get it right. Looks dow…

> email wasn't made for groups I've always wondered why people didn't use newsgroups instead of mailing lists.

It's likely a combination of bad UX, complex set-up, flaky delivery and having no great interface to manage the groups, memberships, unsubscribes. At least that's the parts we're trying to fix.

Re: Ken Thompson's Unix Password

#420

Earlier quoted context omitted.

Many, many years ago when I was in college at the University of Rochester, I found a paper in the computing lab with the root passwords for about twelve machines at Stanford. I emailed them and told them I'd destroyed it but that they should be much more careful. I got yelled at.

Just curious, did you get yelled at because you destroyed the only copy of their password memory aid? ;)

If they were keeping their only copy at an unrelated University thousands of miles away, they had more problems than I thought ;)

I'm actually not sure anymore what the details of their return email was, as it was over 25 years ago. But it was basically, "We will report you to law enforcement if you contact us again."

Post reply on HN