Earlier quoted context omitted.
Wow, you deserve the comment of the day.
For that comment, bitwize should be knighted.
Or queened!
Ken Thompson's Unix Password
201–210 of 665 posts
Re: Ken Thompson's Unix Password
#202Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…
Even if the guy was creepy, you are an asshole revealing something he thought nobody could ever know. That's the same thing like reading his personal letters or similar.
Two considerations here:
1. Is the password private info that the employer shouldn't access?
2. If it is private but someone sees it anyway, should they act on it?
For (1): This is similar to any other private info stored on company equipment. The employer shouldn't actively access it in most cases, but it is generally expected that the employer will access if it has a good reason (in this case, detecting a weak password is a good reason).
For (2): This is similar to accidentally overhearing someone's private conversation. Normally the polite thing is to stop listening, but if you have reason to believe it indicates harmful behaviour (like in this case), the right thing to do is to report it.
Re: Ken Thompson's Unix Password
#203Earlier quoted context omitted.
I worked with someone who had to share a password to solve a major outage. (Yes, I know...) It was a rude comment about a colleague.
Want better password hygiene in the workplace? Encourage rude passwords!
Password rule N+1: "A password must contain at least one word from our list of banned URLs."
At a former job I could not go to one of global corp Tata sites, because tata.
Re: Ken Thompson's Unix Password
#204Earlier quoted context omitted.
The guy wasn't fired for the password, he was fired for the sexual harassment of a coworker. And nothing you do on a work computer is secret from your employer. It's not a "private diary" if you're using your employer's hardware.
>he was fired for the sexual harassment of a coworker OP is vague on what this guy actually did. Note that they only went to the girl after cracking the password, and she said he was "creepy" towards her. "Creepy" in this context might just mean FWU (flirting while ugly).
I was being vague on purpose. He was doing more than FWU.
Re: Ken Thompson's Unix Password
#205Earlier quoted context omitted.
Cliff Stoll's The Cuckoo's Egg grapples with this a bit. The fine line between open systems that anyone can use, and closed systems that protect your privacy and data. It's obviously a settled question these days, but back in the 70s and 80s, this was a bit of a hot topic.
I disagree. I don't think this is at all settled, and in fact is a bit topic right now. The debate has just moved on past personal passwords. For example, chat systems. Do you want an open one where anyone can get on with a minimum of fuss and participate? Or do you want an open one, with controls to manage spam and harassment so that people are able to be open while using it? (I work at Mozilla, where we are moving…
Why not make an anti-spam/harassment ITC bot, and Take Back The Web from Slack?
It's really hard for me to understand what Mozilla's mission is these days.
Re: Ken Thompson's Unix Password
#206Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…
I don't know what to think about this. A password is supposed to be secret so I don't know what a naughty phrase in secret is a violation of? It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.
He was doing a lot more than just the password. I was being vague on purpose. The password just exposed him.
Re: Ken Thompson's Unix Password
#207i deduced my dad's password when I was a middle-schooler. The uni micro had a teletype and although it did not echo password characters, if you mistyped your password, it would print the mistyped password, and knowing a bit about my dad, I could figure out what the correct password was. I logged in and sent himself an email reminding him to use a better password.
Our high school's library computer (in the 90s) logged failed log-ins in a file readable by anyone. Just the username, not the attempted passwords, but the return key on that computer was not reliable and a very common error was that the return key didn't register leading to "usernamepassword" being in the log.
I watched a variation on this in a lecture hall, when the head of school attempted to log into the system and types UsernamePassword into the username field with a big projector running.
Re: Ken Thompson's Unix Password
#208Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…
Tangential but sometimes it is interesting to use a passphrase that you are ashamed of, that way you are never tempted to reveal it.
Re: Ken Thompson's Unix Password
#209Earlier quoted context omitted.
>he was fired for the sexual harassment of a coworker OP is vague on what this guy actually did. Note that they only went to the girl after cracking the password, and she said he was "creepy" towards her. "Creepy" in this context might just mean FWU (flirting while ugly).
I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.
For all its flaws, innocent until proven guilty is still the fairest justice system. Beyond a reasonable doubt is a high standard of proof.
Because we use this standard, it is natural for people to look for reasonable doubts when talking about accusations.
That is how western society works. And for very good reasons.
Re: Ken Thompson's Unix Password
#210This brings back memories of a common exploit w/tftp, such that you could download an unshodowed /etc/passwd file from a remote machine, decrypt it, log into that remote system, collect new hosts from /etc/hosts, then rinse and repeat. Hash rate were pretty slow back then, but the fact that people used passwds straight out of dictionaries helped, so I'm told...