3 ms·
Best one I've seen was a university library card catalog system from the 80s/90s that used unshadowed, 8-character salted passwords via the crypt() function on
by 13of40 9y ago
Best one I've seen was a university library card catalog system from the 80s/90s that used unshadowed, 8-character salted passwords via the crypt() function on the Unix box it was on. Inexplicably, whoever wrote the application had limited it to require exactly five uppercase letters, crackable in a few seconds on my 33Mhz 386.
- romwell 9y agoMaybe that was the reason? To provide a way for the developer to do customer support in these cases, that is. The password being there, as the people in the bike store where I bought the lock told me, to keep the honest people honest.
- 13of40 9y agoAnyone with admin access on the Unix box could have just edited the password file and put in a hash for a password they knew.
- kalleboo 9y agoMy high school in the late 90's similarly handed out passwords all composed of 8 (or was it 6?) numbers. Combined with Windows 98's weak hashing (was it LanMan back then?), Cain & Abel on contemporary hardware could reveal them in seconds.