Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

Post reply on HN
Print view View original

371–380 of 665 posts

Re: Ken Thompson's Unix Password

#371

Post by ineedasername »

noir_lord wrote: post #320
privateSFacct wrote: post #245

Earlier quoted context omitted.

I had both experiences in high school. One situation -> bad result. The other I was made a quasi IT fixer - they put me to work (Novel Netware and other stuff). I would be called out of class to fix things. Since I was naturally super interested in how everything worked together and all the features and the librarians or VP or teachers were not it worked out. At the time I took it reasonably seriously. In hindsight s…

Novell Netware - blast from the past. I had to go apologise to IT (who could barely keep a straight face) at college for sending a message from 'God' saying "I saw what you did last night and it disgusted me". I thought it was going to just the lab but since I was poking around in something I really didn't understand I manage to send it out site wide. Fortunately they saw the funny side.

I sent more than one message from God by telnet to 25. Good times!

Around the same time, someone at my school made a much, much worse semi-accidental prank. Semi-accidental because he didn't think it would work. See, the campus list serve was setup to only allow certain senders to send messages. Makes sense, only a few top administrators should be able to do that. This person theorized that a simple hack, using an authorized person's email, might circumvent the restriction. He was right! Unfortunately, rather than "test 1 2 3" or something, he sent a message, from the president, that all classes had been cancelled. Had he stopped there, maybe it would have been chalked up to a prank. But he went further: The president would be using this free time to, um, entertain amorous visitors at their leisure. So, yeah, expelled. His excuse, when interviewed by the student newspaper, was "I didn't think it would work."

Re: Ken Thompson's Unix Password

#372

Post by andai »

wy35 wrote: post #361
dekhn wrote: post #40

i deduced my dad's password when I was a middle-schooler. The uni micro had a teletype and although it did not echo password characters, if you mistyped your password, it would print the mistyped password, and knowing a bit about my dad, I could figure out what the correct password was. I logged in and sent himself an email reminding him to use a better password.

I remember guessing the admin password of the router back in high school so I could port forward a Minecraft server

It makes me happy to read this. I cracked the admin pass at my school for a really trivial reason, I think I wanted to adjust the audio panning. By default it was set 80% left to compensate for the school's cheap headsets.

Possibly, I also wanted to disable the spyware / remote access they had on all the computers. There no experience quite like having your control of the mouse cursor taken away by an invisible, omnipotent sysadmin. Hilariously, they wouldn't even run a logout command remotely, but actually go to the start menu to do it, I think to make a point.

Re: Ken Thompson's Unix Password

#373

Post by bakul »

jedberg wrote: post #223
bakul wrote: post #222

Earlier quoted context omitted.

A proper policy would’ve been to not have any human look at a user’s password and just email them a warning about their weak password. A password should be considered a PPI (personal, private information) and off limits to others, no matter how creepy (exception being a legal warrant). These days you might gotten in trouble!

Agreed. That's why if I were doing it today, I would just shut off the account after the second warning. Although I don't think it's PII if it's all internal company data, especially if it is known that IT will crack your password.

A password is supposed to be very hard to guess by others but not so hard for you to remember so it can be said to be PII! And no, it is not assumed that IT will crack your password. Because how do you know how far IT would go to crack your password and how do you know they are not looking at your data as well? Employee/company officers' email may contain data that could be highly sensitive and something IT should not be looking at.

Re: Ken Thompson's Unix Password

#374

Post by deanCommie »

harshreality wrote: post #225
tbabb wrote: post #196

Earlier quoted context omitted.

I think it's very interesting how, despite knowing nearly nothing about the situation, everyone here is quick to doubt the victim, and make up scenarios (for which there is zero evidence) where the harasser is the victim.

Because if people don't push back against it, what we get is yet another incarnation of the witch trials. Some people evidently want that, because they're "not a witch" themselves. It's really awful that in some/many cases, accusations of rape or sexual assault or sexual harassment or creepiness end up reducing to one person's word against another, when there's no good objective evidence either way. You should doubt…

First they came for the rapists, and I didn't say anything, because I wasn't a rapist.

Then they came for the sexual harassers, and I didn't say anything, because I wasn't a sexual harasser.

Then they came for the...

Wait, what? That's it? They just wanted to root out the rapist and sexual harassers, and that's it? I can still live my life without worry as long as I'm not one of those?

But okay, maybe your concern is being falsely accused of these things. The incidence rate of false accusations is low to the point of not being relevant to any discussion of social or cultural norms or policy.

Sexual assault is death from drunk driving. False sexual assault accusation is being hit in the head by a milkshake thrown from a moving vehicle.

Re: Ken Thompson's Unix Password

#375

Post by dmd »

JoeAltmaier wrote: post #115

I had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.

You can "impress" people this way still, just by surreptitiously typing Ctrl-u to clear what you've typed so far.

Re: Ken Thompson's Unix Password

#376

Post by MadWombat »

CrazyStat wrote: post #126
MadWombat wrote: post #113

Earlier quoted context omitted.

Closed game is 1. d4 d5. There are quite a few opening lines that start with 1. d4, but do not continue into the closed game.

Which does not change the fact that 1. d4 is the beginning of the closed game.

Yes, and the history of American football starts at Big Bang :)

Re: Ken Thompson's Unix Password

#377

Post by KineticLensman »

Razengan wrote: post #233
JoeAltmaier wrote: post #115

I had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.

Hey that's actually a neat idea! You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters. So people could type in different gobbledegook each time between the characters that matter. To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters. So, if my password is: Any 8 characters, but 2nd character must b…

> You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters

A bank I use does something like this. On account creation you give it a long key string and on subsequent log-in it asks for three different characters (e.g. the 4th, 3rd and 9th characters) from the string.

Re: Ken Thompson's Unix Password

#378

Post by jeena »

tandav wrote: post #333
alpb wrote: post #15

Ken Thompson: > congrats. https://inbox.vuxu.org/tuhs/CAG=a+rj8VcXjS-ftaj8P2_duLFSUpmN...

Offtopic. Many teams use mailing lists. That UX always scared me. Is anybody know good tutorials on how to getting started to use this kind of interfaces?

Many email applications can be set to a threaded view to be able to see who replied what to which message: https://support.mozilla.org/en-US/kb/message-threading-thund...

Re: Ken Thompson's Unix Password

#379

Post by ralfd »

robocat wrote: post #357
yjftsjthsd-h wrote: post #5

I'm shocked at how well the old hashing stood up; sure, it's totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkable. (Granted, it doesn't sound like they did anything fancy like throwing a hundred cloud instances at it or something; I'm not saying you should use DES today:) )

And "Good news — no pwnage found!" On Troy Hunt's https://haveibeenpwned.com/Passwords Which shows that it is fairly strongly "unique", since no-one else has used it and been pwned (or he hasn't reused it and been pwned).

I hope this site is not fishing for passwords ...

Re: Ken Thompson's Unix Password

#380

Post by bobwaycott »

I’m slightly confused by the part where the author states a 7-bit search would take 2 years on a modern GPU, and the answer was found in 4 days on a Vega64. Isn’t that a modern GPU? Have I misunderstood here, or was the author’s math incorrect?
Post reply on HN