Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

Post reply on HN
Print view View original

461–470 of 665 posts

Re: Ken Thompson's Unix Password

#461

Post by mongol »

didibus wrote: post #224
mongol wrote: post #156

Earlier quoted context omitted.

I don't know what to think about this. A password is supposed to be secret so I don't know what a naughty phrase in secret is a violation of? It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.

> It is not very different from writing something naughty in a private diary, or even thinking a naughty thing. I don't know if I'm too normal or what, but my gut feeling is that yes it's really creepy. And all these things have different creepiness to them. Thinking a naughty thing is the least creepy. A private naughty diary is starting to be creepy. If it's just a passage in a normal diary, it's not too bad, if th…

I think there is a big difference between expressing your thoughts from having them. I am quite certain that more or less everyone harbors thoughts that would not be socially acceptable to state to someone in the workplace, but they are completely normal (as in common) thoughts. It is not creepy to have them. It is expressing them to someone that would cross the boundary.

Re: Ken Thompson's Unix Password

#462

Post by tomc1985 »

blackflame7000 wrote: post #446
josephwegner wrote: post #416

Earlier quoted context omitted.

Dang, well done. I spent three solid semesters wasting my "Computer Science" electives on breaking into the Novell system... I found tons of these encrypted passwords, and it never occurred to me to just crack one. I did find plenty of other ways to get in, though :)

Yea historically the SAM file on windows has always been a weak spot because of its NTLM hashing scheme. By breaking passwords larger than 7 letters into multiple sub-password hashes it virtually guaranteed rainbow tables would destroy its security.

Out of curiosity, why did they do this? Was hashing super computationally expensive when NTLM first appeared (NT 3.51 I think?)

Re: Ken Thompson's Unix Password

#463

Post by grzm »

trustissue wrote: post #458

Speaking of passwords, I just discovered that HN will ban your IP address from creating an account if you have a question mark in your password. I assume this is to help against SQL injection? (Not a security person here.) Pretty extreme result, but luckily I can post from another IP. I wonder how many users have hit this and not known why?

While possible, it seems unlikely that this is the case. I'd contact the mods via the Contact link in the footer to resolve the issue.

Re: Ken Thompson's Unix Password

#464

Post by stuntkite »

whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

I did the same thing at my school but it was a brand new SMT magnet school so we showed the net admins and helped to prevent it... Zipslack (first 100mb linux distro) with l0phtcrack was part of my EDC. I believe the first time it was shown to the adults was after someone locked the school network admin out of everything so we helped him recover. We even set up a security lab for the admin team. The next year anything that looked like hacking was grounds for expulsion which lead to a lot more problems with it if you ask me. The school with a wing full of hackers wasn't gonna quit looking at new tools. The school just decided it was like teen sex or smoking. Banned! Lol.

Re: Ken Thompson's Unix Password

#465

Post by nicoburns »

segfaultbuserr wrote: post #322
fwip wrote: post #312

Earlier quoted context omitted.

Yep, you need both the input and hash to be strong. A weak hash reveals information about its input, narrowing the search space. In the example case of md5 or rot13, you can use this to compute collisions for a given hash. Also, a hash that is lightning-quick to compute is faster to brute force. That's why bcrypt has a tunable "cost" factor - to make the hashing take longer and make guessing the password slower.

I used ambiguous language, "strong hash". I should've used "strong KDF" rather than "strong hash", a hash can be strong for other purposes, but makes a poor KDF for hashing passwords, such as single-round SHA-256. In the ideal world, if your password is a random word with 128-bit entropy, no strong KDF is needed, there's no need for PBKDF2, bcrypt, or Argon2, a single round of SHA-256 is sufficient. > In the example…

Some quick (and uninformed) mental maths makes this ~22 random alphanumeric characters:

26 (a-z) + 26 (A-Z) + 10 (0-9) = 62 characters This which can be represented with (just under) 6 bits of information. (2^6 = 64). And 128/6 I'd guess quite a few people who use password managers use password this length...

Re: Ken Thompson's Unix Password

#466

Post by shhsshs »

Gene_Parmesan wrote: post #384
jedberg wrote: post #243

Earlier quoted context omitted.

> How more secure would something like that generally be compared to static passwords? It's not secure at all. If someone knows the rules of the system, the entropy on that is tiny, because it's basically a 2 letter password with only 6/3 options. The only security would be from the obscurity of the attacker not knowing the password rules.

And they would almost certainly know the password rules, because anyone making an account would have to be told the rules in order to understand what was happening.

Unless the rules were unique and hidden for each user!

    User1: 1,3,7,10,12,15
    User2: 2,3,5,8,10,13
I think we’re on to something big.

Re: Ken Thompson's Unix Password

#467

Post by 0xdeadbeefbabe »

hnick wrote: post #435
lhoff wrote: post #389

Earlier quoted context omitted.

Its quite truthworthy. Its run by Troy Hunt (known security researcher) and : "When you search Pwned Passwords The Pwned Passwords feature searches previous data breaches for the presence of a user-provided password. The password is hashed client-side with the SHA-1 algorithm then only the first 5 characters of the hash are sent to HIBP per the Cloudflare k-anonymity implementation. HIBP never receives the original p…

My only concern with the site is some privacy implications. I entered a friend's email just to check for him and it wasn't validated at all, and I found out a few sites he had accounts with. Nothing too concerning was revealed, but privacy for its own sake is a valid goal IMO.

Are you gonna fire Troy?

Re: Ken Thompson's Unix Password

#468

Post by ambicapter »

loeg wrote: post #452
minikites wrote: post #436

Earlier quoted context omitted.

>I never once used it for evil: never read anyone's email, never viewed anyone's private files, never poked around the academic file shares for test solutions, never tried to steal credit card numbers or social security numbers from the finance office's file share. I don't understand this justification. The system owners can't know that to be true and have to proceed as if the systems are compromised. Would you still…

Yes, a good defense against a charge of burglary would be not having stolen anything. In an imaginary perfect criminal justice system, charges/penalties are based on damage done. Less damage done is a lesser crime.

> In an imaginary perfect criminal justice system, charges/penalties are based on damage done.

Hell no. Otherwise you could just set up one gigantic crime by comitting a bunch of small "no damage done" crimes along the way-say, stealing a string of credentials one at a time, but not actually using them until you have all of them together and then you commit your major heist/crime.

Re: Ken Thompson's Unix Password

#469

Post by anaphor »

boomlinde wrote: post #349
tandav wrote: post #333

Earlier quoted context omitted.

Offtopic. Many teams use mailing lists. That UX always scared me. Is anybody know good tutorials on how to getting started to use this kind of interfaces?

A decent email client will display these as a foldable hierarchy, sort of like HN or Reddit's posting interface, just with the body of the posts hidden. With that and full text search it's not so hard. It's the web interfaces that are a bit bulky.

A lot of them will use an algorithm similar to this one https://www.jwz.org/doc/threading.html

Re: Ken Thompson's Unix Password

#470

Post by hnick »

0xdeadbeefbabe wrote: post #467
hnick wrote: post #435

Earlier quoted context omitted.

My only concern with the site is some privacy implications. I entered a friend's email just to check for him and it wasn't validated at all, and I found out a few sites he had accounts with. Nothing too concerning was revealed, but privacy for its own sake is a valid goal IMO.

Are you gonna fire Troy?

Yes, of course.

Actually, I don't understand your comment.

Post reply on HN