Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

651–660 of 665 posts

Re: Ken Thompson's Unix Password

#651

Earlier quoted context omitted.

p/q2-q4! p : pawn / : at q2 : queen's file, rank 2 - : moves to q4 : queen's file, rank 4 ! : good move!

Oh hmm, I didn't realize the notation was so unnecessarily verbose :) Of course it's a pawn moving from q2 to q2, that's the only thing there at the beginning of the game!

Actually in descriptive notation the move would have been:

    P-Q4
Ken padded this out to 8 characters.

Re: Ken Thompson's Unix Password

#652
post #413

Earlier quoted context omitted.

> email wasn't made for groups I've always wondered why people didn't use newsgroups instead of mailing lists.

"Any sufficiently complicated group communication system contains an ad-hoc, informally-specified, bug-ridden, slow implementation of half of Usenet."

uhh... including Usenet?

hmm.. Looks like the Morris Corollary won't work on this version.

Re: Ken Thompson's Unix Password

#653
post #647

Earlier quoted context omitted.

Listen, knowing only OP's side of the story it's easy to sympathize. Especially if he's a part of our inngroup of technical people. Dismissing the whistle-blower as a "kid, that wanted to just fuck someone over" is hardly fair.

snitch

I was wondering when this one would come up. "Snitches end up in ditches" mentality is at fault here.

You pretend that someone cracking everyone's password is not a problem that the organization should address or even know about.

We should not turn our gaze away. "This is not my problem" is simply not a correct response. Snowden knew that, and yet, some people call him a snitch and a traitor.

Re: Ken Thompson's Unix Password

#654

One lone password from the original list, Bill Joy's password, is still uncracked as far as I can tell. Bill Joy is the co-founder of Sun Microsystems, author of vi, and a key developer of BSD UNIX. He apparently picked the best password. Here's the /etc/passwd entry: bill:.2xvLVqGHJm8M:8:10:& Joy,4156424948:/usr/bill:/bin/csh

I already checked all passwords made of any printable character up to 7 symbols length. Full 8-symbol bruteforce will take about 120 days on my hardware, so I prioritized passwords with no special symbols first.

Does anyone with hashcat and GPGPU want to join me?

Re: Ken Thompson's Unix Password

#655
post #452

Earlier quoted context omitted.

Yes, a good defense against a charge of burglary would be not having stolen anything. In an imaginary perfect criminal justice system, charges/penalties are based on damage done. Less damage done is a lesser crime.

> In an imaginary perfect criminal justice system, charges/penalties are based on damage done. Hell no. Otherwise you could just set up one gigantic crime by comitting a bunch of small "no damage done" crimes along the way-say, stealing a string of credentials one at a time, but not actually using them until you have all of them together and then you commit your major heist/crime.

A burglar might kill someone, book them on home invasion charges even if the house was empty.

Re: Ken Thompson's Unix Password

#656
post #645

Earlier quoted context omitted.

You said "... but morality is ..." and just agreed with me, I think? Ultimately, I think it's a case-by-case on this type of thing. Btw, I find it very interesting that e.g. most EU courts will consider "tampered-with" evidence, but obviously take into account that it may have been tampered with and so accord it much less weight than "pristine" evidence. Whereas US courts will[0] absolutely throw out anything that's…

I agreed. I just wanted to take it a stage further and emphasise the definition of 'wrong' is always complex in moral discussions.

Noice :). I apologize for the somewhat aggressive/sarcastic tone at the start of my reply. Reading it back, it sounded so much "more" (in every way) than I intended.

Re: Ken Thompson's Unix Password

#657

Earlier quoted context omitted.

Sigh, I grow tired of pointing this out, but if they were able to figure out someone was doing this, and even who it was, then you weren't a l33t hacker. You used common tools and used a known exploit that people were watching. You broke rules for personal enjoyment and weren't even good enough to not get caught. You didn't beat them, they beat you. It doesn't matter if you went unnoticed for several months, the fact…

He points out below that he was caught because another student overheard him discussing it and ratted on him. I feel like a real hacker wouldn't make a bunch of untested assumptions about situations they have no context for.

Real Hacker™

Re: Ken Thompson's Unix Password

#659
post #483

Earlier quoted context omitted.

Our high school network ran on Novell NetWare, but I wasn't anywhere near smart enough to crack anything so I just wrote a little program in QBASIC that looked like the NetWare login prompt which rejected all login attempts but dumped what was entered into a text file, and left it running on one of the PCs in the computer room. It wasn't even a compiled program, it was just running inside QBASIC's IDE. Yet it was run…

I did the exact same thing, wrote the login faker in pascal. Mine would print the "typo" error message, save credentials, and then log me out and show you the real login screen. I managed to get the passwords of every student and teacher, but alas, I stored them in a file called hacked_passwords.txt , in my home directory. Got busted, and got a dozen saturday detentions.

You learned an important lesson about the importance of naming things.

Re: Ken Thompson's Unix Password

#660

Earlier quoted context omitted.

Oh hmm, I didn't realize the notation was so unnecessarily verbose :) Of course it's a pawn moving from q2 to q2, that's the only thing there at the beginning of the game!

Actually in descriptive notation the move would have been: P-Q4 Ken padded this out to 8 characters.

That makes way more sense!
Post reply on HN