Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

Post reply on HN
Print view View original

621–630 of 665 posts

Re: Ken Thompson's Unix Password

#621

Post by knodi123 »

neotek wrote: post #483
whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

Our high school network ran on Novell NetWare, but I wasn't anywhere near smart enough to crack anything so I just wrote a little program in QBASIC that looked like the NetWare login prompt which rejected all login attempts but dumped what was entered into a text file, and left it running on one of the PCs in the computer room. It wasn't even a compiled program, it was just running inside QBASIC's IDE. Yet it was run…

I did the exact same thing, wrote the login faker in pascal.

Mine would print the "typo" error message, save credentials, and then log me out and show you the real login screen.

I managed to get the passwords of every student and teacher, but alas, I stored them in a file called hacked_passwords.txt , in my home directory. Got busted, and got a dozen saturday detentions.

Re: Ken Thompson's Unix Password

#622

Post by Kinnard »

whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

What ended up happening to you after you got expelled?

Re: Ken Thompson's Unix Password

#623

Post by knodi123 »

masto wrote: post #503
whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

My high school's administrator password was “math”. I think the statue of limitations has expired by now. I got it by writing a simple login spoofer in Turbo Pascal. The funny thing is I never bothered to remove it and after I graduated, I heard from the actual administrator that they were having a strange problem where the first login of the day spit out a disk full error.

> I got it by writing a simple login spoofer in Turbo Pascal.

Ha, I did the exact same thing, in turbo pascal as well!

Man, I miss those simple computer systems. I used to go to other peoples' desks and type the word "end" in column 100 of the first line of their program. They'd go mad with frustration trying to figure out why their program always ran instantly, with zero errors and zero output. Or I'd like them watch me type in my 6-digit numeric password, but they still couldn't log in as me because I was slyly holding down the alt key as I typed, so the password was really a single extended ascii character...

Getting up to all those hijinks gave me a love of computers that really set the direction my life would take.

Re: Ken Thompson's Unix Password

#624

Post by loeg »

ambicapter wrote: post #468
loeg wrote: post #452

Earlier quoted context omitted.

Yes, a good defense against a charge of burglary would be not having stolen anything. In an imaginary perfect criminal justice system, charges/penalties are based on damage done. Less damage done is a lesser crime.

> In an imaginary perfect criminal justice system, charges/penalties are based on damage done. Hell no. Otherwise you could just set up one gigantic crime by comitting a bunch of small "no damage done" crimes along the way-say, stealing a string of credentials one at a time, but not actually using them until you have all of them together and then you commit your major heist/crime.

The crime in this hypothetical degrades from Burglary to Trespass, not "no crime."

Re: Ken Thompson's Unix Password

#625

Post by Quekid5 »

yaseer wrote: post #253
Quekid5 wrote: post #238

Earlier quoted context omitted.

You know, it's quite possible for multiple people to be "wrong" in a given situation. It's possible both the employee and the sysop to be wrong.

I agree, - but morality is sticky and complex. It was obviously wrong to be the creepy sexist. In the abstract sense, it is wrong to invade privacy. But then, if in your invasion of privacy you uncover a wrongdoing, the right thing to do is report it. It would be wrong to read the CFO's email inbox, and probably illegal. But then if you uncover they are committing fraud, you need to report it to police, as well as co…

You said "... but morality is ..." and just agreed with me, I think?

Ultimately, I think it's a case-by-case on this type of thing.

Btw, I find it very interesting that e.g. most EU courts will consider "tampered-with" evidence, but obviously take into account that it may have been tampered with and so accord it much less weight than "pristine" evidence. Whereas US courts will[0] absolutely throw out anything that's shown to be even mildly "tampered-with". I don't know what the right answer is, but it's an interesting question to ponder.

[0] Maybe this is wrong; I'm not a US-ian, so I may not have perfect insight into the court system :|.

Re: Ken Thompson's Unix Password

#626

Post by swiley »

tedmiston wrote: post #517
u801e wrote: post #413

Earlier quoted context omitted.

> email wasn't made for groups I've always wondered why people didn't use newsgroups instead of mailing lists.

Google Groups (kinda) solves this problem. On the viewing side, the app is pretty decent, and then you can still receive / reply through email if desired. A good example group - https://groups.google.com/forum/#!forum/tiddlywikidev I wish Apache projects would move more towards something like this.

Google groups is freaking awful!

It actually was decent in the beginning but with each change google broke more features and made the UI far less usable. Not to mention, you force anyone you want in your group to create a google account.

Re: Ken Thompson's Unix Password

#627

Post by Quekid5 »

WBrad wrote: post #359
yaseer wrote: post #253

Earlier quoted context omitted.

I agree, - but morality is sticky and complex. It was obviously wrong to be the creepy sexist. In the abstract sense, it is wrong to invade privacy. But then, if in your invasion of privacy you uncover a wrongdoing, the right thing to do is report it. It would be wrong to read the CFO's email inbox, and probably illegal. But then if you uncover they are committing fraud, you need to report it to police, as well as co…

I get what you're saying here but: >In the abstract sense, it is wrong to invade privacy. You have no real expectation of privacy when using company owned equipment. This was almost certainly spelled out to the employee in question in the acceptable use policy he agreed to upon being hired. Companies have to operate this way so they can investigate computers if compelled to by court or law, and so they can recover im…

The definition of acceptable use (and expectations of privacy) differs a lot between different countries. For example, in the EU, I believe that any personal email received on a work account is actually considered "beyond reach" of your employer.

I don't know, but I imagine that such considerations could easily extend to your password.

Btw, how did the sysop know that what he recovered was the actual password? I mean, it's unlikely, but at least theoretically possible that it was a false positive. The password hashes in those days were pretty weak... Just a thought; I don't think it realistically was a false positive.

Re: Ken Thompson's Unix Password

#628

Post by CraneWorm »

Aeolun wrote: post #512
daedalus6174 wrote: post #509

Earlier quoted context omitted.

What a punk

That is an understatement. I wonder what kind of backstabber he grew up to be :/

The concerned kind. Refusing to keep their mouth shut when others exploit the system.

This is a problem, here GP is a hero, a hacker, a free spirit. But there is no point in romanticizing such behavior.

If you find a vulnerability in a system, you disclose it to the people that should know about it. You can do that anonymously, or you can alert people in a subtle way.

What you don't do is sit on it and brag to people what a clever person you are.

Re: Ken Thompson's Unix Password

#629

Post by CraneWorm »

waway wrote: post #537
lordlic wrote: post #489

Earlier quoted context omitted.

Yeah. My technical tracks were covered. It was the roommate of one of my friends. He overheard me talking about it and ratted me out.

wow, that's very scummy. That must feel worse than them finding you because you slipped up technically.

> wow, that's very scummy.

You misspelled "prudent".

Re: Ken Thompson's Unix Password

#630

Post by gaius_baltar »

rolleiflex wrote: post #391
tandav wrote: post #333

Earlier quoted context omitted.

Offtopic. Many teams use mailing lists. That UX always scared me. Is anybody know good tutorials on how to getting started to use this kind of interfaces?

This is a common refrain, mailing lists do need a lot of instructions at the bottom to make sense — email wasn't made for groups. It's like 'group' SMS, your phone might provide you with a single chat window with all your friends, but what it really is doing is just sending a separate SMS to every one of the recipients. So you need the 'the manual' attached to every message to make sure people get it right. Looks dow…

> Incidentally, I'm working on a modern version of this whole page in a Reddit-like interface. (https://aether.app) It doesn't solve all of the pains of listserv, but it does help with most, including this one you mentioned.

> Try for free for 14 days

No.

Post reply on HN