91–100 of 665 posts
This bothers me because I prefer to use slightly embarrassing passphrases. I do that because it creates a secondary incentive not to disclose them.
i deduced my dad's password when I was a middle-schooler. The uni micro had a teletype and although it did not echo password characters, if you mistyped your password, it would print the mistyped password, and knowing a bit about my dad, I could figure out what the correct password was. I logged in and sent himself an email reminding him to use a better password.
This bothers me because I prefer to use slightly embarrassing passphrases. I do that because it creates a secondary incentive not to disclose them.
Does that mean that it is embarrassing and can be tied to you or that it is just embarrassing to say? If the first, then wouldn't you risk being pwned and having that used against you?
I'm disappointed that it followed a pattern like that, since that's supposed to make it easier to brute-force guess.
Yes, any sort of logic is weaker than random characters. But this was a long long time ago, hence the weak passwords. Computers couldn't crack things that fast. Today, recommendations are still based on what we expect computers will be able to crack in the foreseeable future. I remember a teacher used the password "music". We had every user's password in plaintext. This was useful when installing a new Windows domain…
This bothers me because I prefer to use slightly embarrassing passphrases. I do that because it creates a secondary incentive not to disclose them.
One of the more interesting things about reused "unique" passwords is they can serve as a fingerprint to link accounts you may not otherwise be able to attribute to the same account/individual.
Earlier quoted context omitted.
That's just a bad system design, not your dad's fault really: "You're password 'huntet2' is invalid" unless the password is just random characters, anyone can guess how it was mistyped. Hell, even if it was just random characters, one could just assume that it's one character-off from the real password, and try shifting each character around.
To be precise, in the case of a patterned password (i.e., dictionary word or something a human can recognize), it leaks all but about 2-3 bits, assuming the human can work out the most likely mistake as in your example, and we assume it's a simple error like a nearby key or simple character flip. If it's a random password, it may still leave 2-3 bits per character as it becomes much harder to know where the error is…
Shouldn't that remain utterly trivial to brute though? If we're assuming all the standard face keys+shifted, I think that's 94 characters. If it's fully unknown then search space is 94^8 or about 6E15, not good but if it's an adaptive hash sizable. But if it's only a one character error, wouldn't you just brute through each of the 8 one by one with only 94 each? That'd reduce it to just 752 possibilities at worst which is so low someone determined could even do it by hand, even ignoring any obvious psychology like the likelihood that the special character isn't the mistake and probably the only special character too.
Certainly not quibbling that it's an awful idea. I don't even like "password hints" so many systems still seem to have, they should be random!
> Did he really use uppercase letters or even special chars? Why would he not? I'm obviously missing something here.
In the early days of unix, people didn't take passwords that seriously and often shared them.
I don’t understand why the author thought it would take years to find this password, as opposed to something closer to the four days it actually took.
Edit: That would be 128^8 =~ 72 quadrillion DES hashes.