Live data from Hacker News

Ken Thompson's Unix Password

leahneukirchen.org

661–665 of 665 posts

Re: Ken Thompson's Unix Password

#661

Earlier quoted context omitted.

Former sysadmin here. I think there's a careful balance that needs to be struck, both by admins and users. As a user, you should realize that when you're on company equipment, privacy is more of a courtesy than a right. It's their equipment you're using. It's reasonable to expect them to use it in a way that furthers the company's interests. So act accordingly. As an admin, you don't ever go digging through stuff for…

> It's their equipment you're using. I don't find this a very good argument. Sourcing inspiration from a sibling comment, it's also the employer's bathroom stall. I might be convinced it's okay to snoop when it comes to their network usage, but this is not the argument to do so.

Responding late, but yeah, you raise a valid point.

The difference to me is in the purpose of the two facilities. A toilet is there for the employees' physical needs and more or less no other purpose. A computer is there primarily to do business work on. The company has a clear need to be involved in how that computer is used in several ways, such as maintaining its security, monitoring its performance, making sure it isn't misused, etc. They can afford you some privacy, but only on a best-effort basis because it's not reasonable to be entirely hands off.

Re: Ken Thompson's Unix Password

#662
post #646

Earlier quoted context omitted.

The definition of acceptable use (and expectations of privacy) differs a lot between different countries. For example, in the EU, I believe that any personal email received on a work account is actually considered "beyond reach" of your employer. I don't know , but I imagine that such considerations could easily extend to your password. Btw, how did the sysop know that what he recovered was the actual password? I mea…

That is true, there are stronger privacy protections in the EU in general. I don't consider the actions here morally justifiable, just legally. As far as it being the actual password, a false positive AND the fact he had been creeping on a coworker at the same time seems extraordinarily unlikely to me.

Agreed about the false positive, btw. It was just a hypothetical, but court cases ("beyond reasonable doubt") have a very high standard of proof.

Re: Ken Thompson's Unix Password

#663

One lone password from the original list, Bill Joy's password, is still uncracked as far as I can tell. Bill Joy is the co-founder of Sun Microsystems, author of vi, and a key developer of BSD UNIX. He apparently picked the best password. Here's the /etc/passwd entry: bill:.2xvLVqGHJm8M:8:10:& Joy,4156424948:/usr/bill:/bin/csh

It's now been cracked - and now we know why it took so long:

https://minnie.tuhs.org/pipermail/tuhs/2019-October/019124.h...

Re: Ken Thompson's Unix Password

#664

One lone password from the original list, Bill Joy's password, is still uncracked as far as I can tell. Bill Joy is the co-founder of Sun Microsystems, author of vi, and a key developer of BSD UNIX. He apparently picked the best password. Here's the /etc/passwd entry: bill:.2xvLVqGHJm8M:8:10:& Joy,4156424948:/usr/bill:/bin/csh

I already checked all passwords made of any printable character up to 7 symbols length. Full 8-symbol bruteforce will take about 120 days on my hardware, so I prioritized passwords with no special symbols first. Does anyone with hashcat and GPGPU want to join me?

Preimage found and about to be disclosed: https://inbox.vuxu.org/tuhs/90ffe509-76b5-6629-c55a-7785815f...

And yes, again it is related to chess.

Re: Ken Thompson's Unix Password

#665
post #624

Earlier quoted context omitted.

> In an imaginary perfect criminal justice system, charges/penalties are based on damage done. Hell no. Otherwise you could just set up one gigantic crime by comitting a bunch of small "no damage done" crimes along the way-say, stealing a string of credentials one at a time, but not actually using them until you have all of them together and then you commit your major heist/crime.

The crime in this hypothetical degrades from Burglary to Trespass, not "no crime."

Trespass is not a crime per se. It's a tortious act. Criminal trespassing is when you commit trespassing when specifically told to leave and you don't or do it again.
Post reply on HN