Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

Post reply on HN
Print view View original

501–510 of 665 posts

Re: Ken Thompson's Unix Password

#501

Post by avens19 »

whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

Our high school's local admin password on every machine was the name of the school district. Used it to install P2P software and emulators on lots of the machines throughout my time there. On grad day I was setting up a slideshow with my CS teacher and the domain login wasn't working. I said "just log in with local admin". He said "I don't know the password". I did it in front of him. His words: "I don't want to know what you've done with this"

Re: Ken Thompson's Unix Password

#502

Post by darkfire613 »

whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

My school district was the Madison Metropolitan School District. I discovered quite by accident that the admin password for the school computers was just ‘mmsd’. It was literally my first guess.

Re: Ken Thompson's Unix Password

#503

Post by masto »

whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

My high school's administrator password was “math”. I think the statue of limitations has expired by now.

I got it by writing a simple login spoofer in Turbo Pascal. The funny thing is I never bothered to remove it and after I graduated, I heard from the actual administrator that they were having a strange problem where the first login of the day spit out a disk full error.

Re: Ken Thompson's Unix Password

#504

Post by laughinghan »

1000units wrote: post #353
jedberg wrote: post #331

Earlier quoted context omitted.

I said "being creepy" because I was being vague. He was doing much worse than that.

Like what? I have an ex-girlfriend whom I dumped when she (among other things) called my family and lied about me getting into a horrible accident because we were arguing about her [several hard street drugs] addiction. I cared about her enough to stick around until after the drug problems started. She tells people I'm a "creep" when she explains why we didn't work out, because we had been together for a while and I…

I'm sorry that happened, that sounds like a terrible situation.

Do you see how I took you at your word and extended sympathy, rather than questioning whether you're misrepresenting the situation? Is there something you know about the facts of jedberg's situation that lead you not to do the same?

Re: Ken Thompson's Unix Password

#505

Post by tracker1 »

Interresting. :-)

When I create hashes for systems, I actually, now create a "version" prefix for hashes... this way I can on-run upgrade to a newer hash at login (if/when needed).

Have upgraded a older systems this way... after 30 days, dumped any that hadn't changed and sent emails notifying that they'd have to use the "forgot password" option the next time they wanted to login.

Currently using pbkdf2/hmacsha512*100000 for password hashing. 16-byte salt, 32byte result... varying too far from NIST guidelines would have been a hard sell.

output base64 values: v#.SALT.HASH

Re: Ken Thompson's Unix Password

#506

Post by LukeShu »

tandav wrote: post #333
alpb wrote: post #15

Ken Thompson: > congrats. https://inbox.vuxu.org/tuhs/CAG=a+rj8VcXjS-ftaj8P2_duLFSUpmN...

Offtopic. Many teams use mailing lists. That UX always scared me. Is anybody know good tutorials on how to getting started to use this kind of interfaces?

For the most part, you wouldn't use the web interface, which exists mostly for archival/search-engine purposes. You use a plain email program, and get used to hitting "reply all" instead of "reply" (this will have it be "To:" the person you're replying to, and will "Cc:" the mailing list address), you send a regular email to the mailing list address when you want to start a new thread. A halfway decent email program will thread the replies, like HN does.

Re: Ken Thompson's Unix Password

#507

Post by brigandish »

ambicapter wrote: post #468
loeg wrote: post #452

Earlier quoted context omitted.

Yes, a good defense against a charge of burglary would be not having stolen anything. In an imaginary perfect criminal justice system, charges/penalties are based on damage done. Less damage done is a lesser crime.

> In an imaginary perfect criminal justice system, charges/penalties are based on damage done. Hell no. Otherwise you could just set up one gigantic crime by comitting a bunch of small "no damage done" crimes along the way-say, stealing a string of credentials one at a time, but not actually using them until you have all of them together and then you commit your major heist/crime.

Mens rea is an important consideration so it's not just about damage done (though the fear a key could be used in pursuit of a worse crime is also a harm) but the intent/recklessness of an act.

Re: Ken Thompson's Unix Password

#509

Post by daedalus6174 »

lordlic wrote: post #489
zippergz wrote: post #472

Earlier quoted context omitted.

Do you know how they ended up finding out about it and catching you?

Yeah. My technical tracks were covered. It was the roommate of one of my friends. He overheard me talking about it and ratted me out.

What a punk

Re: Ken Thompson's Unix Password

#510

Post by AgentME »

neotek wrote: post #483
whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

Our high school network ran on Novell NetWare, but I wasn't anywhere near smart enough to crack anything so I just wrote a little program in QBASIC that looked like the NetWare login prompt which rejected all login attempts but dumped what was entered into a text file, and left it running on one of the PCs in the computer room. It wasn't even a compiled program, it was just running inside QBASIC's IDE. Yet it was run…

This is exactly why some versions of Windows required you to press ctrl-alt-delete to open the login form. Programs aren't allowed to block Windows from receiving ctrl-alt-delete, so a fake login program would not be able to stay on the screen after the user pressed ctrl-alt-delete. (Of course this only works if the user knows to always hit ctrl-alt-delete when they go to login. If the user sees an already-open (fake) login screen and does not hit ctrl-alt-delete, then they're vulnerable.)
Post reply on HN