Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

441–450 of 665 posts

Re: Ken Thompson's Unix Password

#441
post #278

Earlier quoted context omitted.

> That is how western society works. And for very good reasons. Is the implication that non-Western societies don't work that way? Or that somehow it's only Western societies that came up and all of them practice this behavior?

Actually, yes. (Hopefully you were asking rather than woke-scolding). Presumption of innocence traces back to roman law (hence "occidental" from the latin, meaning the going down/setting of the sun, or "western", referring to European countries) . It has propagated at various rates through various cultures. Other cultures (including germanic, which could also be classified as "western") did not have the presumption o…

Always interesting when a statement is unpopular, but no counterarguments are presented.

A bit more clarification from the researchgate link above, talking about the movement toward presumption of innocence (POI) in China (emphasis added to the statements that Western societies came up with this behavior and that at least one non-Western society doesn't work that way):

"As POI is a legal principle originating in the West, its acceptance in the criminal justice context of China is a gradual and longstanding process. The CPL’s first revision, in 1996, adopts the clause ‘no person shall be found guilty without being judged as such by a People’s Court according to law’, but the protection guaranteed to criminal defendants under Article 12 of the CPL (2012) is different from the classic concept, which, according to the International Covenant on Civil and Political Rights (ICCPR), requires POI. Article 12 focuses on who has the power to issue a guilty verdict rather than on the presumption of the accused’s guilt or innocence during the investigation and trial."

Re: Ken Thompson's Unix Password

#442

Earlier quoted context omitted.

I said "being creepy" because I was being vague. He was doing much worse than that.

Like what? I have an ex-girlfriend whom I dumped when she (among other things) called my family and lied about me getting into a horrible accident because we were arguing about her [several hard street drugs] addiction. I cared about her enough to stick around until after the drug problems started. She tells people I'm a "creep" when she explains why we didn't work out, because we had been together for a while and I…

"...hardcore schizophrenia..."

As opposed to the softcore kind, natch.

Re: Ken Thompson's Unix Password

#443
post #370

Did anyone bother to ask Ken’s permission first before publishing his password on the public internet? Based on his reaction he clearly didn’t mind, but still!

The /etc/passwd file from which this password was unearthed has a date of Jan 5 1980 (from a 3BSD tar file). Presumably ken has updated his password since then.

One would hope, but it still seems like common courtesy to give him a heads up.

Re: Ken Thompson's Unix Password

#444
post #253

Earlier quoted context omitted.

You know, it's quite possible for multiple people to be "wrong" in a given situation. It's possible both the employee and the sysop to be wrong.

I agree, - but morality is sticky and complex. It was obviously wrong to be the creepy sexist. In the abstract sense, it is wrong to invade privacy. But then, if in your invasion of privacy you uncover a wrongdoing, the right thing to do is report it. It would be wrong to read the CFO's email inbox, and probably illegal. But then if you uncover they are committing fraud, you need to report it to police, as well as co…

> It was obviously wrong to be the creepy sexist.

It's not obvious as we haven't heard his side of the story.

Re: Ken Thompson's Unix Password

#445
post #196

Earlier quoted context omitted.

>he was fired for the sexual harassment of a coworker OP is vague on what this guy actually did. Note that they only went to the girl after cracking the password, and she said he was "creepy" towards her. "Creepy" in this context might just mean FWU (flirting while ugly).

I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.

There's solid evidence he was fired.

Re: Ken Thompson's Unix Password

#446

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

Dang, well done. I spent three solid semesters wasting my "Computer Science" electives on breaking into the Novell system... I found tons of these encrypted passwords, and it never occurred to me to just crack one. I did find plenty of other ways to get in, though :)

Yea historically the SAM file on windows has always been a weak spot because of its NTLM hashing scheme. By breaking passwords larger than 7 letters into multiple sub-password hashes it virtually guaranteed rainbow tables would destroy its security.

Re: Ken Thompson's Unix Password

#447

Earlier quoted context omitted.

I was expelled from university for pulling off the exact same exploit with the "workstation only" feature in Novell. In my case, they put a computer in every dorm room, and every single one of them had a domain-wide administrator account cached in its SAM file. It was inevitable that a student would find it. It's been almost 15 years now but I believe the password was rac3c4r or something trivial like that. I ran Oph…

>I never once used it for evil: never read anyone's email, never viewed anyone's private files, never poked around the academic file shares for test solutions, never tried to steal credit card numbers or social security numbers from the finance office's file share. I don't understand this justification. The system owners can't know that to be true and have to proceed as if the systems are compromised. Would you still…

> Would you still feel safe if a burglar broke into your house and left a note saying they didn't take anything?

That doesn't make it okay, but it certainly should result in a much lesser sentence than if the perpetrator had damaged or stolen property.

Re: Ken Thompson's Unix Password

#448

Earlier quoted context omitted.

Even if the guy was creepy, you are an asshole revealing something he thought nobody could ever know. That's the same thing like reading his personal letters or similar.

Ok, what about this scenario? Jack sets his password to "ImgoingtokillyouKaren". Tyler is talking with Jack in his cube and sees Jack type in the password and goes to HR. Is that an asshole move, in your opinion? Is the violation the reveal of the password or something else? In my opinion, he has an obligation and responsibility to say something if he thinks someone is in danger or being harassed.

What if his buddy John's password is "HiJack!"? Is it logical to treat that the same way as if he yelled it in an airport?

Re: Ken Thompson's Unix Password

#449
post #346

Did anyone bother to ask Ken’s permission first before publishing his password on the public internet? Based on his reaction he clearly didn’t mind, but still!

In my opinion this was a pretty crappy thing to do. Password could contain personal and potentially embarrassing information, even if that wasn't the case here.

This was a crappy thing to do even though the reason it is crappy wasn't the case here?

Re: Ken Thompson's Unix Password

#450

Earlier quoted context omitted.

I used ambiguous language, "strong hash". I should've used "strong KDF" rather than "strong hash", a hash can be strong for other purposes, but makes a poor KDF for hashing passwords, such as single-round SHA-256. In the ideal world, if your password is a random word with 128-bit entropy, no strong KDF is needed, there's no need for PBKDF2, bcrypt, or Argon2, a single round of SHA-256 is sufficient. > In the example…

Can ROT-13 really be called a hash though? It's literally an ancient chipher.

All ciphers are also hashes.

Using chaining, encipherment of the last block is also a hash of the whole input.

Secure hashes are optimized for different characteristics than typical ciphers, but with enough headroom and time each can fill in for the other.

Of course some are not very good, for either use.

Post reply on HN