Troy, please add this breach to https://haveibeenpwned.com/Passwords
Ken Thompson's Unix Password
381–390 of 665 posts
Re: Ken Thompson's Unix Password
#382I had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.
I discovered that's the way my banking app actually worked until only a few updates ago. The password was originally limited to 8 characters (why this was the case for an online bank password is beyond me) but the app would allow you to enter more characters into the password input. It only accepted the first 8 characters though so anything you entered after those was ignored. I discoveres this when I mistyped my pas…
I’ve had the goddamn Citibank _require_ that I use a password 6 or 7 characters long on one of their systems. This year (2019).
Re: Ken Thompson's Unix Password
#383Earlier quoted context omitted.
Novell Netware - blast from the past. I had to go apologise to IT (who could barely keep a straight face) at college for sending a message from 'God' saying "I saw what you did last night and it disgusted me". I thought it was going to just the lab but since I was poking around in something I really didn't understand I manage to send it out site wide. Fortunately they saw the funny side.
I sent more than one message from God by telnet to 25. Good times! Around the same time, someone at my school made a much, much worse semi-accidental prank. Semi-accidental because he didn't think it would work. See, the campus list serve was setup to only allow certain senders to send messages. Makes sense, only a few top administrators should be able to do that. This person theorized that a simple hack, using an au…
I send unauthenticated email on port 25, every semester, in front of my students, as part of a discussion on internet application protocols. I can't use "God", because the addresses are validated, but I do send "from" the school's IT director. I even give them the commands to do it themselves (along with a strict talking to about how it's not truly anonymous because their network access is authenticated).
I've been able to do it at every university I've studied or worked at.
Re: Ken Thompson's Unix Password
#384Earlier quoted context omitted.
Hey that's actually a neat idea! You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters. So people could type in different gobbledegook each time between the characters that matter. To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters. So, if my password is: Any 8 characters, but 2nd character must b…
> How more secure would something like that generally be compared to static passwords? It's not secure at all. If someone knows the rules of the system, the entropy on that is tiny, because it's basically a 2 letter password with only 6/3 options. The only security would be from the obscurity of the attacker not knowing the password rules.
And they would almost certainly know the password rules, because anyone making an account would have to be told the rules in order to understand what was happening.
Re: Ken Thompson's Unix Password
#385Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed…
What would be a weak creepy password? I feel those properties run opposite. Weak enough to be bruteforced and creepy enough to get fired. Good job on that fella’s part I would say!
A string of dictionary words and a very common name.
Re: Ken Thompson's Unix Password
#386That password was pretty long - could be a complete windowing system written in J.
The password is only the last 8 characters, everything before the colon is the password's hash.
I'm certainly not going to let reality get in the way of a joke about the compact expressiveness of J.
Re: Ken Thompson's Unix Password
#387Earlier quoted context omitted.
30 years ago I cracked everyone’s Unix password on an old Sun computer. It didn’t take long because everyone had a password that was in the dictionary. Needless to say, people were not happy with the messenger.
I remember in middle school using "arena" as a password. "No one will ever guess this!"
At my middle school the default password for all accounts was "linux". The school was Windows (Win2k) only ;) it was around 2006/2007)
I had access to a dozent Teacher accounts from oder ones who never used a Computer.
Actually that was the first time that i heard the word Linux and learned the meaning just few years later.
Re: Ken Thompson's Unix Password
#388Earlier quoted context omitted.
And "Good news — no pwnage found!" On Troy Hunt's https://haveibeenpwned.com/Passwords Which shows that it is fairly strongly "unique", since no-one else has used it and been pwned (or he hasn't reused it and been pwned).
I hope this site is not fishing for passwords ...
If you have JavaScript enabled, the cleartext password is hashed in the browser and the hash is truncated, and a list based on the truncated hash is retrieved to be checked against - the only information leaked is that you searched for one password amongst many. Read Troy's articles about how fishing is protected against - I have written the above from memory.
You can download all the hash files if you wish to run purely locally.
Also the site hosting Troy's list is Cloudflare. Cloudflare act as a https proxy for a large number of sites, so they already have access to a large number of passwords.
Re: Ken Thompson's Unix Password
#389Earlier quoted context omitted.
And "Good news — no pwnage found!" On Troy Hunt's https://haveibeenpwned.com/Passwords Which shows that it is fairly strongly "unique", since no-one else has used it and been pwned (or he hasn't reused it and been pwned).
I hope this site is not fishing for passwords ...
Its quite truthworthy. Its run by Troy Hunt (known security researcher) and : "When you search Pwned Passwords
The Pwned Passwords feature searches previous data breaches for the presence of a user-provided password. The password is hashed client-side with the SHA-1 algorithm then only the first 5 characters of the hash are sent to HIBP per the Cloudflare k-anonymity implementation. HIBP never receives the original password nor enough information to discover what the original password was." from https://haveibeenpwned.com/Privacy
Re: Ken Thompson's Unix Password
#390I guess he’s lucky that the password wasn’t anything embarrassing. What if the password had been “I love sex” or something?