Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

Post reply on HN
Print view View original

251–260 of 665 posts

Re: Ken Thompson's Unix Password

#251

Post by close04 »

nexuist wrote: post #128
parsimo2010 wrote: post #124

Earlier quoted context omitted.

I don't know for sure, but these Radeon GPUs are power hungry and hot. It could be just that after multiple days the entire computer is heat soaked and goes through more thermal throttling than even the "steady state" GPU tests that most gamers do (a few hours). It might also be cruft building up over time with small memory leaks or imperfect memory management.

This is what I thought too, the heat simply becomes overwhelming and the unit has to underclock to prevent melting.

I think the "towards the end" part is the misleading one. The software has no idea where the end is or it would just jump there. Since the run took 4 days slowing down due to throttling would happen pretty fast as the card reaches a thermal equilibrium. Certainly wouldn't take days to do it.

It's more likely the explanation above of something (not heat) accumulating over time and slowing down the processing.

Re: Ken Thompson's Unix Password

#252

Post by munk-a »

reedwolf wrote: post #184
CydeWeys wrote: post #167

Earlier quoted context omitted.

The guy wasn't fired for the password, he was fired for the sexual harassment of a coworker. And nothing you do on a work computer is secret from your employer. It's not a "private diary" if you're using your employer's hardware.

>he was fired for the sexual harassment of a coworker OP is vague on what this guy actually did. Note that they only went to the girl after cracking the password, and she said he was "creepy" towards her. "Creepy" in this context might just mean FWU (flirting while ugly).

Just to note

> He was already being super creepy and making the girl who sat across from him uncomfortable, but she never told anyone.

The OP actually did mention that there was prior bad stuff that had gone unreported (quite possibly due to a power imbalance). In the end:

1. Nobody is getting fired over a password alone.

2. Traditionally it's been very balanced against women reporting such things.

Re: Ken Thompson's Unix Password

#253

Post by yaseer »

Quekid5 wrote: post #238
brosinante wrote: post #221

Earlier quoted context omitted.

Yes, creepy sexists need our protection and it's exactly the same thing as playing farmville on the bathroom.

You know, it's quite possible for multiple people to be "wrong" in a given situation. It's possible both the employee and the sysop to be wrong.

I agree, - but morality is sticky and complex.

It was obviously wrong to be the creepy sexist.

In the abstract sense, it is wrong to invade privacy.

But then, if in your invasion of privacy you uncover a wrongdoing, the right thing to do is report it.

It would be wrong to read the CFO's email inbox, and probably illegal. But then if you uncover they are committing fraud, you need to report it to police, as well as confess your own crime.

Unfortunately, there's never easy rules for these things.

Re: Ken Thompson's Unix Password

#254

Post by astine »

CydeWeys wrote: post #167
mongol wrote: post #156

Earlier quoted context omitted.

I don't know what to think about this. A password is supposed to be secret so I don't know what a naughty phrase in secret is a violation of? It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.

The guy wasn't fired for the password, he was fired for the sexual harassment of a coworker. And nothing you do on a work computer is secret from your employer. It's not a "private diary" if you're using your employer's hardware.

I think that it's the conjunction of the password and the harassment accusation together that make this a fairly straightforward case. If it were just a creepy password, well, that demonstrates a certain level of creepiness but doesn't mean that he made it a problem for anyone else. It's possible to have private fantasies that remain private. On the other hand, if it was just the coworker's accusation, it would be just that, an accusation without evidence.

The password as evidence of private creepiness lends credence to the accusations of harassment, and the accusation of harassment demonstrates the the creepiness was probably not just private. Together they create a case stronger than either alone.

Re: Ken Thompson's Unix Password

#255

Post by parliament32 »

Quekid5 wrote: post #238
brosinante wrote: post #221

Earlier quoted context omitted.

Yes, creepy sexists need our protection and it's exactly the same thing as playing farmville on the bathroom.

You know, it's quite possible for multiple people to be "wrong" in a given situation. It's possible both the employee and the sysop to be wrong.

It's one of those "everyone sucks here" situations.

Re: Ken Thompson's Unix Password

#256

Post by airstrike »

barneygale wrote: post #219
bcatanzaro wrote: post #209

Earlier quoted context omitted.

For all its flaws, innocent until proven guilty is still the fairest justice system. Beyond a reasonable doubt is a high standard of proof. Because we use this standard, it is natural for people to look for reasonable doubts when talking about accusations. That is how western society works. And for very good reasons.

It's how the courts work, but not society in general. An individual can use whatever standard they wish to form an opinion. Would you insist that we all treat O.J. Simpson as innocent?

> An individual can use whatever standard they wish to form an opinion.

I suppose we can all agree that any individual should at least first know the facts before forming their opinion.

Re: Ken Thompson's Unix Password

#257

Post by Razengan »

jedberg wrote: post #243
Razengan wrote: post #233

Earlier quoted context omitted.

Hey that's actually a neat idea! You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters. So people could type in different gobbledegook each time between the characters that matter. To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters. So, if my password is: Any 8 characters, but 2nd character must b…

> How more secure would something like that generally be compared to static passwords? It's not secure at all. If someone knows the rules of the system, the entropy on that is tiny, because it's basically a 2 letter password with only 6/3 options. The only security would be from the obscurity of the attacker not knowing the password rules.

> because it's basically a 2 letter password with only 6/3 options.

That was obviously an oversimplified example to explain the rules.

In practice you could make it as obscure as you want, while keeping it easy for you to remember.

Like the sentences I just typed here. No limit on the number of characters. I could enter different long sentences each time, as long as the characters at specific positions match certain sets.

Re: Ken Thompson's Unix Password

#258

Post by S-E-P »

panopticon wrote: post #194
300bps wrote: post #181

Earlier quoted context omitted.

Not to mention "creepy" is a charge that is often impossible to defend yourself from. It's wholly dependent on the subjectivity of the accuser and their opinion of the accused. Walk over and say good morning every day to a coworker and she finds you attractive? Charming and sweet. Walk over and say good morning every day to a coworker and she finds you unattractive? Creepy.

I was sorta with you at first, but that second paragraph is straight-up nonsense.

I've seen it happen, though it sounds like someone is over exaggerating women's reaction to their ugly mug.

But yeah, I knew a woman that said anyone who smiled at her was creepy if she didn't like them they exist.

Re: Ken Thompson's Unix Password

#259

Post by munk-a »

kissgyorgy wrote: post #152
jedberg wrote: post #143

Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…

Even if the guy was creepy, you are an asshole revealing something he thought nobody could ever know. That's the same thing like reading his personal letters or similar.

Honestly, assume that everything on a work computer is being tracked - if the IT dude had managed to crack this fellow's personal email password then that's a different matter altogether.

Re: Ken Thompson's Unix Password

#260

Post by segfaultbuserr »

yjftsjthsd-h wrote: post #5

I'm shocked at how well the old hashing stood up; sure, it's totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkable. (Granted, it doesn't sound like they did anything fancy like throwing a hundred cloud instances at it or something; I'm not saying you should use DES today:) )

> I'm shocked at how well the old hashing stood up; sure, it's totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkable

It's not because the hash is strong, but the password itself is strong (if the attackers don't know additional information about chess). The sole purpose of using a strong hash or a KDF on password is making low-entropy passphrase harder to crack by increasing the cost of every round, especially for cryptographic purposes. But if the passphrase is already strong (6 random words from the Diceware wordlist), you can use MD5, and I won't be surprised if it takes one year to crack. Having 10 random words is guaranteed to be uncrackable under all circumstances, because it's literally a 128-bit key.

If your password has 80-bit of entropy, it makes even listing all possible passwords (without any hashing or encryption) a difficult job. Symmetric encryption works in a similar way, it's secure not because of the computational resources it takes, but the number of possible keys it has.

What is the moral of the story? Consider to use a password manager!

Post reply on HN