I’ve had the goddamn Citibank _require_ that I use a password 6 or 7 characters long on one of their systems. This year (2019).
What system is this? I had used a 20+ character password on their website using my password manager to enter it every time. One day they said the password was wrong, which was unlikely since the password manager was entering it. I ended up doing a password reset and set it to something shorter like 15 characters, and then it worked. I don't know if they truncate or not, but they've definitely allowed much longer pass…
I think it was the one for showing you the pin of a corporate credit card.
Isn't this more like duplicating everyones house key? He never actually went into the houses.
Except he went in the Admin's house: > I'd just log in with the admin account and run pwdump
Just to be clear, in case this matters, it wasn't an account belonging to an administrator, it was a default superuser account called (if I remember right) "TECH" in all caps, and didn't have any files or anything in it. It's not like it was a person and I was poking around their private stuff.
I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…
One day I was board in comp sci and decided to CD into drives a - z. Found a bunch of Novelle NetWare utils sitting on a hidden drive. One of them listed all the users on the system, while another sent back generic user info. Thing is, this was a very large high school and a bunch of accounts never signed in. All you had to do was log in with a blank password and it would prompt you to select one on login. Any funny business on the network was done on a burner account. It was all just fun and games, but never did get caught. Although, one of my teachers did say the network admin sent out an email to all my teachers, telling them not to let me touch their computer. No matter. It would be foolish to login from a location that has a record of you physically being there.
I don't know what to think about this. A password is supposed to be secret so I don't know what a naughty phrase in secret is a violation of? It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.
I had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.
Hey that's actually a neat idea! You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters. So people could type in different gobbledegook each time between the characters that matter. To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters. So, if my password is: Any 8 characters, but 2nd character must b…
This is exactly why some versions of Windows required you to press ctrl-alt-delete to open the login form. Programs aren't allowed to block Windows from receiving ctrl-alt-delete, so a fake login program would not be able to stay on the screen after the user pressed ctrl-alt-delete. (Of course this only works if the user knows to always hit ctrl-alt-delete when they go to login. If the user sees an already-open (fake…
I think ctrl-alt-delete generates a hardware interrupt.
In real mode, the BIOS intercepts it. But it's still not a hardware interrupt; it just never gets to the OS.
Isn't this more like duplicating everyones house key? He never actually went into the houses.
Only if you can know he didn't actually go in. Even now, do you believe he never liked at a single private file?
What possible reason would I have to lie about it? You think I'm worried about investigators raiding my VPN service so they can track down and charge a grown-ass man in juvenile court for something that happened 15 years ago? You think I'm worried about my reputation on this throwaway account with a grand total of five previous comments? What's the point in believing that this whole escapade happened at all if you're going to randomly doubt a particular element of it?
I was a kid, I was stupid, but I wasn't an asshole. I didn't go peeking and violating people's privacy because that would have been a dick move. Just like tons of people on Hacker News today have access to personal data on SaaS systems we maintain and don't go peeking. Just like tons of people are perfectly capable of picking their neighbor's locks but don't walk into their house for no reason. It's not even tempting. I don't care what's in my neighbor's house, and I don't care what's in random other students' homework documents or email or whatever. The only interesting part was breaking the security.
> How more secure would something like that generally be compared to static passwords? It's not secure at all. If someone knows the rules of the system, the entropy on that is tiny, because it's basically a 2 letter password with only 6/3 options. The only security would be from the obscurity of the attacker not knowing the password rules.
And they would almost certainly know the password rules, because anyone making an account would have to be told the rules in order to understand what was happening.
> (those familiar know the hash-rate fluctuates and slows down towards the end) Could someone explain this to me, why does it slow down towards the end?
I suspect it's because the farther down the rule list you go, the more complicated the rules get.
Password cracking often uses rule lists to modify known passwords lists in some way (adding 123 to the end, for example). These get more complicated towards the end so they take more operations.