Ken Thompson's Unix Password

Also, I didn't actually go in anyone's house. If passwords are really so inherently private even apart from their access implications, maybe we shouldn't be sharing Ken Thompson's old password.

  root:OVCPatZ8RFmFY:Ernie Co-vax --> cowperso
  daemon:*:The devil himself --> (login not allowed)
  bill:.2xvLVqGHJm8M:Bill Joy --> (password still unknown)
  ozalp:m5syt3.lB5LAE:Ozalp Babaoglu --> 12ucdort
  sklower:8PYh/dUBQT9Ss:Keith Sklower --> theik!!!
  kridle:4BkcEieEtjWXI:Bob Kridle --> jilland1
  kurt:olqH1vDqH38aw:Kurt Shoens --> sacristy
  schmidt:FH83PFo4z55cU:Eric Schmidt --> wendy!!!
  hpk:9ycwM8mmmcp4Q:Howard Katseff --> graduat;
  tbl:cBWEbG59spEmM:Tom London --> ..pnn521
  jfr:X.ZNnZrciWauE:John Reiser --> 5%ghj
  mark:Pb1AmSpsVPG0Y:Mark Horton --> uio
  dmr:gfVwhuAMF0Trw:Dennis Ritchie --> dmac
  ken:ZghOT0eRm4U9s:Ken Thompson --> p/q2-q4!
  sif:IIVxQSvq1V9R2:Stuart Feldman --> axolotl
  scj:IL2bmGECQJgbk:Steve Johnson --> pdq;dq
  pjw:N33.MCNcTh5Qw:Peter J. Weinberger --> uucpuucp
  bwk:ymVglQZjbWYDE:Brian W. Kernighan --> /.,/.,
  uucp:P0CHBwE/mB51k:UNIX-to-UNIX Copy --> whatnot
  srb:c8UdIntIZCUIA:Steve Bourne --> bourne
  finger::The Finger Program --> (no pw but runs a program, not a login shell)
  who::The Who Program --> (no password but runs a program, not a login shell)
  w::The W Program --> (no password but runs a program, not a login shell)
  mckusick:AAZk9Aj5/Ue0E:Kirk McKusick --> foobar
  peter:Nc3IkFJyW2u7E:Peter Kessler -- ...hello
  henry:lj1vXnxTAPnDc:Robert Henry --> sn74193n
  jkf:9ULn5cWTc0b9E:John Foderaro --> sherril.
  fateman:E9i8fWghn1p/I:Richard Fateman --> apr1744
  fabry:d9B17PTU2RTlM:Bob Fabry --> 561cml..
  network:9EZLtSYjeEABE:(no name listed) --> network (runs a program, not a login shell)
  tty:: --> (no password but runs a program, not a login shell)

- spouses' names (jilland1, wendy!!!, sherril.)

- birth dates (apr1744 might be April 17, 1944)

- the first word that came to your mind (whatnot, foobar, ...hello)

- though a few were thoughtful (sn74193n is a synchronous binary counter from the 7400-series chip family and likely immune to dictionary attack in that era)

- easy to type patterns on a keyboard (/.,/., or 5%ghj)

- obscure words (axolotl is a Mexican walking fish)

- different languages (12ucdort is 1,2,3,4 in Turkish)

- and some people didn't care (Steve Bourne, inventor of the Bourne shell, picked "bourne")

I saw /etc/passwd and asked my boss how to decrypt the passwords. He told me it was a one-way encryption, so the login program would just encrypt the password you provided and compare to the encrypted value. He went on explaining the old crypt algorithm and even made a bet I could not guess his password. He said it was related to a movie.

So at 17 I was hooked and started studying the sources. In the end I just patched and recompiled the passwd binary to store clean text passwords in a hidden file. Later I learned this was called a trojan horse.

And even now, 30 years later, I remember his face when I told the movie was Citizen Kane and his password was "rosebud".

Thank you Miguel and Gorgonio for teaching me about C and Unix! This knowledge paid my rent for 3 decades and I still love the job.

[1] http://www.internationaloffice.unicamp.br/english/teaching/g...

[2] https://en.wikipedia.org/wiki/RS-232

Not that it makes any real difference here with such a small search space, but in this scenario (known typo, information revealed) it's less likely. Remember, we're considering a human typing something out on a keyboard, so the probabilities aren't fully random. If we're trying to use probabilities to cut down the search space further, a caret character requires shifting well away from the home row (shift-6 US standard qwerty) so it's more likely to represent active intent. Perhaps it could be % or & (shift-5/shift-7), but if you know someone is trying to type a password out and has made a typo then a left/right neighbor with shifting preserved is an easy place to start guessing.

Obviously, this whole thing is such an awful idea and breaks everything so badly that it's all kind of theoretical anyway, hopefully no software has had behavior like this for a long time. And any actual brute force program today has far more sophisticated pattern attacks based on the enormous corpus of password leaks and knowledge there now is, which is why it's foolish to try to try to be clever with passwords rather then just generating something fully randomized.