Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

141–150 of 665 posts

Re: Ken Thompson's Unix Password

#141

Earlier quoted context omitted.

No good deed goes unpunished.

More specifically, pointing out someone else's stupidity is rarely welcome.

Many, many years ago when I was in college at the University of Rochester, I found a paper in the computing lab with the root passwords for about twelve machines at Stanford. I emailed them and told them I'd destroyed it but that they should be much more careful. I got yelled at.

Re: Ken Thompson's Unix Password

#142
post #8
post #7

>Since the DES-based crypt(3) algorithm used for these hashes is well known to be weak (and limited to at most 8 letters) >ZghOT0eRm4U9s:p/q2-q4! How is that 8 letters?

The part before : is the hash, the part after is the cracked 8 character password.

Thank you for explaining this.

Re: Ken Thompson's Unix Password

#143
Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it.

If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed them their password in plain text using our internal email system. Jury's still out on whether that was a good idea. :)

The next week we just disabled your account and you had to come to IT to fix it.

One guy actually got fired for his password. He was already being super creepy and making the girl who sat across from him uncomfortable, but she never told anyone. Then we cracked his password, which was a very naughty phrase about the girl who sat across from him. I reported it to HR, who asked the girl, who then said he was creepy, and so they acted swiftly on the reports and got him out of there.

Re: Ken Thompson's Unix Password

#144

Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…

I'm all for the effective strength enforcement and ejecting the creepy guy, but some people do have strong passwords that, a bad idea though it may be, embed something deeply personal to them. Just something to keep in mind before automating the sharing of cracked passwords for otherwise legitimate purposes. I consider my passwords my private information, even if they are no longer secure from a technical standpoint and shouldn't be in use. I hope people respect that if they come across them.

Re: Ken Thompson's Unix Password

#145
post #63

This bothers me because I prefer to use slightly embarrassing passphrases. I do that because it creates a secondary incentive not to disclose them.

It's probably actually easier to learn vulgar passwords. Well vulgar anything really, it's a memorization trick we were taught in school to find a way to relate boring things to sex. Probably anything that has strong emotional valence works.

Re: Ken Thompson's Unix Password

#146

Earlier quoted context omitted.

Uphill! Both ways! How many fewer calories do I burn when typing on a low-travel keyboard rather than an old mainframe keyboard?

Probably not very many. According to XKCD What If? [1] a modern keyboard takes around 2 millijoules to press a key. Typing a full novel would take a few kilojoules. Even if an old mainframe keyboard took 10x more power to press the keys you would save less than a AA battery worth of energy over writing a full novel. [1] https://what-if.xkcd.com/102/

Using some conversions from an internet site, one AA battery is 1.3e4 Joules and a human requires 8.4e6 Joules per day, so about 133 seconds of energy saved per 6 months of novel, or two lost seconds of calorie burning exercise every three days.

(Lots of sketchy napkin math here)

Re: Ken Thompson's Unix Password

#147
post #127
post #91

Earlier quoted context omitted.

Does that mean that it is embarrassing and can be tied to you or that it is just embarrassing to say? If the first, then wouldn't you risk being pwned and having that used against you?

I worked with someone who had to share a password to solve a major outage. (Yes, I know...) It was a rude comment about a colleague.

Want better password hygiene in the workplace? Encourage rude passwords!

Re: Ken Thompson's Unix Password

#148

Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…

I'm all for the effective strength enforcement and ejecting the creepy guy, but some people do have strong passwords that, a bad idea though it may be, embed something deeply personal to them. Just something to keep in mind before automating the sharing of cracked passwords for otherwise legitimate purposes. I consider my passwords my private information, even if they are no longer secure from a technical standpoint…

I wonder if that process was passed by legal first. Not only does it make private (in most user's minds) information public, it also makes it legally discoverable!

Re: Ken Thompson's Unix Password

#150

Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…

I'm all for the effective strength enforcement and ejecting the creepy guy, but some people do have strong passwords that, a bad idea though it may be, embed something deeply personal to them. Just something to keep in mind before automating the sharing of cracked passwords for otherwise legitimate purposes. I consider my passwords my private information, even if they are no longer secure from a technical standpoint…

Given the frequency of online password db breaches, this seems like a really bad idea...
Post reply on HN