Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

Post reply on HN
Print view View original

231–240 of 665 posts

Re: Ken Thompson's Unix Password

#231

Post by sterkekoffie »

mongol wrote: post #214
sterkekoffie wrote: post #192

Earlier quoted context omitted.

What if it was violent, bigoted, or suicidal? Passwords are secret but they aren't necessarily private. If you wouldn't want to verbally verify it with your administrator you probably shouldn't use it.

I have seen many password policies that says that you never should disclose your password. I have never seen a password policy say that it must not be naughty. As for violent or suicidal, I am less sure. I guess I would reason like a doctor, who has a patient's privacy to consider, but when certain lines are crossed he can contact the police if he think there is risk of crime.

Then I think our only difference in opinion is whether making sexually aggressive statements about your coworkers is crossing a line or just "naughty."

Re: Ken Thompson's Unix Password

#232

Post by jodrellblank »

politelemon wrote: post #74

> (those familiar know the hash-rate fluctuates and slows down towards the end) Could someone explain this to me, why does it slow down towards the end?

For some context of how hashcat works with GPUs:

https://hashcat.net/wiki/doku.php?id=frequently_asked_questi...

Then:

https://hashcat.net/wiki/doku.php?id=frequently_asked_questi...

It isn’t running a single thread at 100% GPU use until the end, it has to partition up the search space and balance how it creates possible passwords on the CPU, on the GPU, and based on the kind of attack patterns you asked for - and when it’s getting to the end of the search space, some of the search space partitions are done and the remaining ones aren’t enough to load the GPU fully, so hash throughout drops.

Re: Ken Thompson's Unix Password

#233

Post by Razengan »

JoeAltmaier wrote: post #115

I had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.

Hey that's actually a neat idea! You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters.

So people could type in different gobbledegook each time between the characters that matter.

To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters.

So, if my password is: Any 8 characters, but 2nd character must be A/B/C/x/y/z, and the 6th must be !/@/# then I could type:

    9A4jc@23

    #C(@$!as

    oxo!c#-1
or any other valid combinations to get in.

How more secure would something like that* generally be compared to static passwords?

* (Of course this is a simplified example for illustration. In practice you'd use more characters/options.)

Re: Ken Thompson's Unix Password

#234

Post by RandallBrown »

lolc wrote: post #63

This bothers me because I prefer to use slightly embarrassing passphrases. I do that because it creates a secondary incentive not to disclose them.

In college my roommate and I made our wifi password something like a fart joke. Perfectly fine to tell to our close friends, but kinda embarrassing.

One day, at the end of the semester, our female neighbor knocked on our door and asked if she could use our wifi since she was moving out the next day and had already canceled her Internet.

I would have been happy to share with her, but I couldn't bring myself to tell her the password. Instead I just said my roommate was "really weird about sharing our wifi" and apologized.

I don't think that incident ever actually made me change the password though.

Re: Ken Thompson's Unix Password

#235

Post by tzs »

colejohnson66 wrote: post #153
hangonhn wrote: post #117

Earlier quoted context omitted.

Would this suggest that 3DES with a sufficiently long password is still safe for now?

Doubt it. It took 4 days for just one top of the line GPU. Any dedicated attacker will have farms to parallelize it even further. It’s not exactly linear, but with just 4 GPUs (~$4000; well within the reach of any dedicated attacker), that’s one day. Not to mention the fact that GPUs have still been roughly following Moore’s Law in terms of performance. It’s probably safe from the casual attacker who just downloads a…

> If I can crack a DES password in 4 days, I can crack a 3DES password in 12

It's multiplicative, not additive. 3DES is about 2^56 times as difficult to crack as DES. (Not 2^112 times because there is an attack that effectively limits it to twice the effective bits of DES, rather than the three times you might expect at first).

Re: Ken Thompson's Unix Password

#237

Post by TimTheTinker »

barneygale wrote: post #219
bcatanzaro wrote: post #209

Earlier quoted context omitted.

For all its flaws, innocent until proven guilty is still the fairest justice system. Beyond a reasonable doubt is a high standard of proof. Because we use this standard, it is natural for people to look for reasonable doubts when talking about accusations. That is how western society works. And for very good reasons.

It's how the courts work, but not society in general. An individual can use whatever standard they wish to form an opinion. Would you insist that we all treat O.J. Simpson as innocent?

> Would you insist that we all treat O.J. Simpson as innocent?

The fair way is to withhold judgment (while presuming innocence) when there's a charge against someone but it hasn't been investigated. That's fair whether we're talking about courts or society. Society pronounced its judgment on O.J. after evidence was presented and witnesses testified.

The problem comes when people presume guilt based on a charge alone. Unfortunately, that's often what happens when high-emotion charges are leveled against someone.

Re: Ken Thompson's Unix Password

#238

Post by Quekid5 »

brosinante wrote: post #221
parliament32 wrote: post #197

Earlier quoted context omitted.

I'm conflicted about this. I know I'd be pretty upset if an employer starting talking to me about a plaintext password that's supposed to be hashed. The problem is that they brute forced it and then sent it directly off to HR? Yes, as a sysadmin it's perfectly acceptable to be searching for weak passwords, but reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to do. As an admin you ha…

Yes, creepy sexists need our protection and it's exactly the same thing as playing farmville on the bathroom.

You know, it's quite possible for multiple people to be "wrong" in a given situation. It's possible both the employee and the sysop to be wrong.

Re: Ken Thompson's Unix Password

#239

Post by aasasd »

floatingatoll wrote: post #101
frou_dh wrote: post #84

He would have had to expend quite some calories to type that out every time on an ancient keyboard with chunky keys and massive travel.

Uphill! Both ways! How many fewer calories do I burn when typing on a low-travel keyboard rather than an old mainframe keyboard?

I can just say that attempting to even begin learning to play bass guitar had me exercising the fingers for two–three hours before they stopped feeling like wooden sticks on the strings. Almost every day. I.e. mashing the keyboard is no workout at all.

This means, however, that a typewriter would likely noticeably exhaust a modern keyboard jockey, though not in eight characters (hopefully). But dunno about teletypes.

Re: Ken Thompson's Unix Password

#240

Post by CathedralBorrow »

bcatanzaro wrote: post #209
tbabb wrote: post #196

Earlier quoted context omitted.

I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.

For all its flaws, innocent until proven guilty is still the fairest justice system. Beyond a reasonable doubt is a high standard of proof. Because we use this standard, it is natural for people to look for reasonable doubts when talking about accusations. That is how western society works. And for very good reasons.

> That is how western society works.

No, that's how justice systems in western society (and many others) work. Because guilty/not-guilty is a binary choice, there's no in-between option.

I don't have the same binary restrictions when I form an opinion based on the information available to me. As we all do.

Post reply on HN