Ken Thompson's Unix Password • Hacker News Board

Re: Ken Thompson's Unix Password

#571

Post by takeda » Thu, Oct 10, 2019, 6:47 AM UTC

zerocrates wrote: post #484

tomc1985 wrote: post #462

Earlier quoted context omitted.

Out of curiosity, why did they do this? Was hashing super computationally expensive when NTLM first appeared (NT 3.51 I think?)

The "split into 7s" thing is from LM, which goes back to the OS/2 days... and it uses DES, which operates with 56-bit keys: 7 8-bit characters. Old DES-based crypt() has a similar limit: 8 7-bit characters. NT hashes use MD4, which wasn't invented until 1990.

I believe LM also stored the passwords in uppercase as well. The NTLM password was used, but LM was also saved for compatibility (by default) with older Windows machines.

L0pth Crack utilized this when cracking, it first found the uppercase password, then it only had to brute force the case when cracking NTLM.

Re: Ken Thompson's Unix Password

#572

Post by mikorym » Thu, Oct 10, 2019, 6:58 AM UTC

Surely this was a perhaps modified dictionary attack that solved it in the end?

I don't understand the comments that describe (presumably random) 10+ char passwords as "crackable".

Re: Ken Thompson's Unix Password

#573

Post by chupasaurus » Thu, Oct 10, 2019, 7:01 AM UTC

FroshKiller wrote: post #485

saagarjha wrote: post #316

Earlier quoted context omitted.

If you had a keylogger, it wouldn't really matter how good your authentication scheme is…

Keyloggers aren’t very useful when authentication uses TOTPs from a hardware token.

TOTPs from a hardware tokens aren't very useful if system doesn't support TOTP as an auth backend.

Re: Ken Thompson's Unix Password

#574

Post by tempodox » Thu, Oct 10, 2019, 7:37 AM UTC

Digital archaeology has always been an interest of mine. Must be fascinating to investigate such antique artifacts.

Re: Ken Thompson's Unix Password

#575

Post by mncolinlee » Thu, Oct 10, 2019, 7:44 AM UTC

berbec wrote: post #50

Interestingly enough, this password does not show up on haveibeenpwnd!

That's what you get for a game where king white hat tries to capture king black hat by keeping him in check.

Re: Ken Thompson's Unix Password

#576

Post by govg » Thu, Oct 10, 2019, 7:50 AM UTC

eyeundersand wrote: post #149

syastrov wrote: post #118

Earlier quoted context omitted.

That cracked me up

I don't understand. Please help.

It has pawn in it.

Re: Ken Thompson's Unix Password

#577

Post by oneeyedpigeon » Thu, Oct 10, 2019, 7:54 AM UTC

fluidcruft wrote: post #145

lolc wrote: post #63

This bothers me because I prefer to use slightly embarrassing passphrases. I do that because it creates a secondary incentive not to disclose them.

It's probably actually easier to learn vulgar passwords. Well vulgar anything really, it's a memorization trick we were taught in school to find a way to relate boring things to sex. Probably anything that has strong emotional valence works.

Yup, Moonwalking with Einstein explains this phenomenon well. I know I'll never forget 'Sex On Hard Concrete Always Hurts The Orgasmic Areas', which my Maths teacher passed on ~30 years ago.

Re: Ken Thompson's Unix Password

#578

Post by nvarsj » Thu, Oct 10, 2019, 8:07 AM UTC

jonny383 wrote: post #564

whalesalad wrote: post #400

I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crac…

I got kicked out of school when I was fifteen for doing this. My class was the first year to have a mandatory laptop program. Each laptop was running Windows XP on the schools AD domain. I booted up OPH-crack at home, and didn't get a result. So then I torrented a larger rainbow table and ran it again for three days. Boom, there I had it. My motivation for this was wanting to install my own software on the laptop tha…

Wow - this is awful. For simply getting admin rights on your own laptop? How do school admins get away with treating the kids like inmates? Good on your dad, he handled it well.

Re: Ken Thompson's Unix Password

#579

Post by Kiro » Thu, Oct 10, 2019, 8:11 AM UTC

rwmj wrote: post #17

Kiro wrote: post #2

> Did he really use uppercase letters or even special chars? Why would he not? I'm obviously missing something here.

Typing on a teletype is painful at the best of times. One reason why common Unix commands are so short. Edit: Yes I have used a teletype, connected to an Elliott computer, I believe it was a 903 or at least it looked very much like this: http://www.computinghistory.org.uk/det/32480/Elliott-903

Stupid question but how do you actually type on that thing? I don't see anything resembling a keyboard.

Re: Ken Thompson's Unix Password

#580

Post by reachtarunhere » Thu, Oct 10, 2019, 8:12 AM UTC

lordlic wrote: post #489

zippergz wrote: post #472

Earlier quoted context omitted.

Do you know how they ended up finding out about it and catching you?

Yeah. My technical tracks were covered. It was the roommate of one of my friends. He overheard me talking about it and ratted me out.

It's always that kid. I did something similar in high school with luckily no serious repercussions but yup it was another kid who ratted me out. I could have changed my grades and stuff but luckily I was pretty content. The network admin who I really looked up to and asked lots of technical questions vouched for me. I think the fact that I only played around with the admin account for fun and never touched anything else helped my case.