Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

It was Bill Joy's password, not Ken Thompson's, that had a control character

minnie.tuhs.org

Post reply on HN
Print view View original

51–58 of 58 posts

Re: It was Bill Joy's password, not Ken Thompson's, that had a control character

#51

Post by cantrevealname »

If anyone would like to try their own hand at discovering Bill Joy's 1970s-era password, here's how to get started with the hashcat tool. First check if everything is working by trying a known result, e.g., Dennis Ritchie's password which we know was "dmac":

  apt-get install hashcat
  echo "dmac" > guesses
  hashcat --force -m 1500 -a 0 gfVwhuAMF0Trw guesses
If see you a message that says, "gfVwhuAMF0Trw:dmac" and "Status: Cracked", it's working. Now put in Bill Joy's hash ".2xvLVqGHJm8M" in place of "gfVwhuAMF0Trw" and a list of guesses, one per line, in the guesses file, and run hashcat again.

We've been told that the password is a chess-related word, all lowercase letters except that one letter is a matching control character, such as in "b^Ishop" where the "i" is actually a control-I.

Re: It was Bill Joy's password, not Ken Thompson's, that had a control character

#52

Post by rasz »

kevin_thibedeau wrote: post #14
capableweb wrote: post #6

Earlier quoted context omitted.

Like the rest of us, get browsing! https://minnie.tuhs.org/pipermail/tuhs/ Might as well add a disclaimer: back in the days, in order to find the gold nuggets on the web, you had to shift through shit. A lot of shit. But then once in a while, you find those little nuggets that made the whole shit-shifting worthwhile. Useful exercise in patience for beginner webbers maybe.

Google can't monetize this content so it ends up on page 5 behind all the irrelevant SEO links.

Google Groups should have this, but search in Groups is permanently broken. Search, you know, Googles main domain.

Re: It was Bill Joy's password, not Ken Thompson's, that had a control character

#53

Post by pingyong »

cantrevealname wrote: post #48

For everyone who finds this story confusing, I'll try a recap: The password file on UNIX systems from 1969 right up till the 1990s were readable by everyone on the system. However, the passwords were one-way encrypted or "hashed". For the password a user typed such as "p/q2-q4!", the password file contained a hash such as "ZghOT0eRm4U9s". It used to be a rite of passage of every aspiring UNIX systems programmer to wr…

Pretty interesting that those guys took what are essentially joke passwords. Seems like they probably didn't expect anyone to bother trying to crack them.

Re: It was Bill Joy's password, not Ken Thompson's, that had a control character

#54

Post by harry8 »

chousuke wrote: post #47
harry8 wrote: post #44

Earlier quoted context omitted.

Apparently it's off-color to dare suggest password cracking without permission is an invasion of privacy(!) I don't recall anyone suggesting private passwords have no expectation of privacy myself but clearly people here think it to be so. So that's weird and just a bit creepy.

In what way is cracking a password hash an invasion of privacy? The act itself is completely harmless and legal; it is only a problem if you use said password to actually access the person's systems. It is also part of the hacker culture to test other people's security in a white-hat manner. This is a good thing. If my password were weak enough to be cracked in this way, I'd certainly prefer someone do it and tell me…

Breaching someone's privacy where they have the reasonable expectation of having privacy is a problem always in all circumstances. Does the benefit outweigh it? Not in this case.

You crack and you know what kind of thing that person uses for a pass phrase. If they created their pass phrase with the belief that it was private it could very well be something they don't wan't published. something like "I like big butts and I cannot lie" is the least embarrassing thing. Do they love Sir Mixalot? Are they mysognist? Was it somethign they just overheard and used with zero thought? There should be no such speculation because we shouldn't even know. You shouldn't have to explain what you've used or justify it because you have the complete expectation of privacy. It's a private thought with private context - "get the hell out of my mind - I didn't ask you in here", I don't want you to form opinions about a private thought. I don't want you or anyone anywhere near my private thoughts.

Creep is a generally farily well accepted pejoritive term for someone who wilfully invades privacy for their own amusement. I do mean it to be pejoritive. It is reasonable to form the view that being pejorative in this case has merits. But sure, disagree all you like, make the case, no doubt the NSA would agree the privacy invasion is ok.

This is not security testing. This is straight up curiousity & giggles of "what did $famous_person use for a pass phrase?" It's nobody's business. If you want to know, ask. If the person has forgotten and gives you permission, then you crack like a well mannered and respectful human being.

I think that is an entirely reasonable point of view. If it stung some people then that's worthwhile.

Re: It was Bill Joy's password, not Ken Thompson's, that had a control character

#55

Post by technofiend »

anon9001 wrote: post #41
technofiend wrote: post #40

Earlier quoted context omitted.

I hear you. The very first system Unix system I had root to ended up with two etc directories. It took a really long time to figure out I hadn't corrupted the filesystem but instead had created one directory named /etc which was an unprintable character.

`mkdir -- "$(echo "-rf \u2215")"` is a fun one for someone else to anxiously rm later ;)

Lol. The lessons I learned about ls -lq, ls -li and find -inum have stuck with me since then, though.

Re: It was Bill Joy's password, not Ken Thompson's, that had a control character

#56

Post by dredmorbius »

DrStalker wrote: post #46
gm3dmo wrote: post #23

They all had their uid set to 0?

From memory setting a UID to 0 was a way to effectively have multiple root accounts on a system. sudo is a much better solution to the same problem so using uid 0 in this manner is not something I expect to see on any modern unix/linux system.

"shutdown" or "reboot" as a UID=0 user with shell set to "/sbin/shutdown" or "/sbin/reboot" and a specific password is still occasionally found. Log in as that to shut down or reboot system.

Re: It was Bill Joy's password, not Ken Thompson's, that had a control character

#57

Post by lejar »

carokann wrote: post #50
EvanAnderson wrote: post #25

If you read on in the thread there's this fun story[1]: > John P. Linderman jpl.jpl at gmail.com > Sat Oct 19 23:11:10 AEST 2019 > Related story. A user came to us with a problem while we were in our computer room. We asked him to log in at the VAX console, so we could look into the problem. Moments later, dozens of users flooded in, asking what had happened. Seems the first user had a CTRL-P in his password, which,…

I do this all the time with bash. I run a python script, and try to ctrl+c the output of it while it's still running. My brain refuses to learn right click.

ctrl+shift+c will copy it. :)

Re: It was Bill Joy's password, not Ken Thompson's, that had a control character

#58

Post by EamonnMR »

TheDong wrote: post #20
EamonnMR wrote: post #5

So much interesting content is locked in these oldschool mailing lists, how does a modern-day web user get into them?

You need an email account in order to join a mailing list, so get one of those. Your ISP probably gives you one, but you can also use one of the more obscure email providers like yahoo or gmail if you want. I'm a fan of fastmail on my own domain. Once you have an email address, this content is now available to you! Most mailing lists are free and easy to subscribe to.

I understand the concept of a mailing list, but how do you discover new lists?
Post reply on HN