34 ms·
Ken Thompson's Unix Password
- rpmisms 7y agoI'm disappointed that it followed a pattern like that, since that's supposed to make it easier to brute-force guess.
- floatingatoll 7y agoIt seems likely that someone will write an archaic chess notation pattern engine into the crackers now that this has been discovered and shared widely.
- henrik_w 7y agoI agree, but didn't seem to help in this case though :-)
- lucb1e 7y agoYes, any sort of logic is weaker than random characters. But this was a long long time ago, hence the weak passwords. Computers couldn't crack things that fast. Today, recommendations are still based on what we expect computers will be able to crack in the foreseeable future. I remember a teacher used the password "music". We had every user's password in plaintext. This was useful when installing a new Windows domain controller and setting all the passwords (about 30 employees in the school) instead or copying hashes or letting them set their own passwords. In hindsight, I find it batshit crazy that some stupid intern (me) walked around the school with a sheet of paper with literally everyone's password on it, logging into people's systems where necessary or potentially forgetting the sheet somewhere. I'm not saying this never happens anywhere in the world anymore, but I do think security mindset changed in the last decades.
- tom_mellior 7y agoOn the other hand, being admin on a system is not that different. Sure, you don't have users' passwords, but you can still do arbitrary stuff in their name. Very large organizations will have some sort of system that logs this stuff and that you can't tamper with, but in a lot of places you could easily cover your tracks.
- UI_at_80x24 7y agoEdward Snowden would agree.
- lucb1e 7y agoI would argue that having passwords made up by users and having access to a user's work account is a little different. In the former case, I see what kind of password they use and can guess that they reuse the password (or a variant) elsewhere. I can also take knowledge if I get fired, but my admin permissions are revoked.
- sonofgod 7y agocirca 1995: Teacher had password written on the BACK of the clipboard they carried around everywhere. Said teacher's password was 'qwerty'. (Yes, it worked)
- zymhan 7y agoI still have 0 idea what's interesting about this. How is this a chess move?
- mark212 7y agothe password is the last part: p/q2-q4! it's a notational way in the chess program (written by Ken Thompson) to describe a chess move, "pawn from Queen's 2 to Queen's 4." A very common opening move that "puts a pawn in the center, controlling the important e5-square, and opens the line for the Bc1."[1] The notation is old. Modern notation would just write it as "d4" because there's only one piece (a pawn) who can move to that square as the first move and only one spot from which it can move (d2). [1] https://www.chess.com/openings/A40-Queens-Pawn-Opening https://www.chess.com/openings/A40-Queens-Pawn-Opening
- hundchenkatze 7y agohttps://en.wikipedia.org/wiki/Chess_notation https://en.wikipedia.org/wiki/Chess_notation
- theemathas 7y agohttps://en.wikipedia.org/wiki/Chess_notation https://en.wikipedia.org/wiki/Chess_notation See the "chess notation examples" table. The password doesn't match any chess notation, but it's close enough that it's obviously (to me) intended to be a chess move. In particular, it moves the pawn in front of the queen (in the initial position) forwards two spaces.
- Kiro 7y ago> Did he really use uppercase letters or even special chars? Why would he not? I'm obviously missing something here.
- empath75 7y agoIn the early days of unix, people didn't take passwords that seriously and often shared them.
- adossi 7y agoI would have borrowed "/.,/.," a long time ago had I heard about it sooner. That is just way too convenient.
- asdfman123 7y agoMy first password ever was qazwsx and I used it until I learned that it's included in "known" password text files and thus instantly crackable. However, I wonder how safe it is to take an "easy" password like /.,/.,/., and then add a bunch of exclamation points to the end, so that it's both long and not part of a dictionary. I'm sure password crackers are advanced enough to first try taking common passwords and then adding human modifications to make them more secure. But something like MyDogRules###########! seems like it could be very secure, actually.
- giancarlostoro 7y agoIs your username an ode to this somehow? :) Mr. Asdf sir
- asdfman123 7y agoNope, but by an old internet meme: https://knowyourmeme.com/memes/asdfmovie https://knowyourmeme.com/memes/asdfmovie
- 7y ago
- yjftsjthsd-h 7y agoI'm shocked at how well the old hashing stood up; sure, it's totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkable. (Granted, it doesn't sound like they did anything fancy like throwing a hundred cloud instances at it or something; I'm not saying you should use DES today:) )
- melling 7y ago30 years ago I cracked everyone’s Unix password on an old Sun computer. It didn’t take long because everyone had a password that was in the dictionary. Needless to say, people were not happy with the messenger.
- tonyedgecombe 7y agoNo good deed goes unpunished.
- zackbloom 7y agoMore specifically, pointing out someone else's stupidity is rarely welcome.
- technothrasher 7y agoMany, many years ago when I was in college at the University of Rochester, I found a paper in the computing lab with the root passwords for about twelve machines at Stanford. I emailed them and told them I'd destroyed it but that they should be much more careful. I got yelled at.
- sverige 7y agoJust curious, did you get yelled at because you destroyed the only copy of their password memory aid? ;)
- 7y ago
- carlmr 7y ago>Since the DES-based crypt(3) algorithm used for these hashes is well known to be weak (and limited to at most 8 letters) >ZghOT0eRm4U9s:p/q2-q4! How is that 8 letters?
- ryanlol 7y agoThe part before : is the hash, the part after is the cracked 8 character password.
- larrik 7y agostill 13 characters... edit: LOL, I guess I'm a little dumb today
- teddyuk 7y ago8
- deleted 7y ago[deleted]
- progval 7y ago"p/q2-q4!" is the password, "ZghOT0eRm4U9s" is the password's hash. "p/q2-q4!" is 8 characters.
- ct0 7y agoVery easy to type as well
- BeeOnRope 7y agoThe password is p/q2-q4! which is 8 characters.
- freeplay 7y agop/q2-q4! That is the password. 8 characters.
- deleted 7y ago
- apetresc 7y agoA slight nitpick with the article - `p/q2-q4` (more commonly written as "1. d4" in modern times) is not the Closed Game, it's just the first move of it. There are many, many other lines after 1. d4 besides just 1. ..d5, most of them quite open!
- CrazyStat 7y agoIt is the beginning of the closed game, which is what the article says. Seems like a vacuous nitpick.
- throw7 7y agoIs it? I mean, I'm not a chess expert, but can we actually call a chess game open or closed from only the first move?
- CrazyStat 7y ago1.d4 d5 is called the Closed Game. It's the name of the opening, just like the Ruy Lopez or the Benko Gambit.
- throw7 7y agooh, today i learned there are opening moves called the "Open Game" and the "Closed Game" and there are also "open" and "closed" games in chess.
- umanwizard 7y agoI am not a strong player, so I could be wrong, but my understanding is that 1. d4 d5 games tend to be more closed than 1. e4 e5 games, because it's less easy for the center pawns to get taken (because they are defended by the queens). If any stronger player wants to comment, I'd be interested to know whether this is indeed the main reason 1. d4 d5 games tend to lead to more closed positions.
- 7y ago
- mkoryak 7y agoI was able to log into his facebook and twitter accounts using that same password! Edit: Ha ha, this is a bad joke!
- alpb 7y agoKen Thompson: > congrats. https://inbox.vuxu.org/tuhs/CAG=a+rj8VcXjS-ftaj8P2_duLFSUpmNgB4-dYwnTsY_8g5WdEA@mail.gmail.com/ https://inbox.vuxu.org/tuhs/CAG=a+rj8VcXjS-ftaj8P2_duLFSUpmN...
- oefrha 7y agoKen Thompson is a top poster. Busted.
- elcritch 7y agoHe’s probably a bit peeved he has to use a new password. ;)
- tandav 7y agoOfftopic. Many teams use mailing lists. That UX always scared me. Is anybody know good tutorials on how to getting started to use this kind of interfaces?
- codegladiator 7y agoEach reply has its own page, just click next/prev to follow the thread (or jump using the tree at the bottom)
- xhgdvjky 7y agoI'd recommend finding a mailing list conversation about a topic you know and then hitting all the buttons (there are only a few). you should be able to figure out the links from context
- boomlinde 7y agoA decent email client will display these as a foldable hierarchy, sort of like HN or Reddit's posting interface, just with the body of the posts hidden. With that and full text search it's not so hard. It's the web interfaces that are a bit bulky.
- 7y ago
- fao_ 7y agoWow, I didn't expect the thread to go this far
- buboard 7y agoSeems hard to remember. Could it be a collision?
- mseepgood 7y agoSo he moved on from chess to Go?
- caseyw 7y agoI laughed here. Thank you kind human!
- dekhn 7y agoi deduced my dad's password when I was a middle-schooler. The uni micro had a teletype and although it did not echo password characters, if you mistyped your password, it would print the mistyped password, and knowing a bit about my dad, I could figure out what the correct password was. I logged in and sent himself an email reminding him to use a better password.
- Gunax 7y agoThat's just a bad system design, not your dad's fault really: "You're password 'huntet2' is invalid" unless the password is just random characters, anyone can guess how it was mistyped. Hell, even if it was just random characters, one could just assume that it's one character-off from the real password, and try shifting each character around.
- CrazyStat 7y agoEven better if you can find it mistyped two different ways.
- jerf 7y agoTo be precise, in the case of a patterned password (i.e., dictionary word or something a human can recognize), it leaks all but about 2-3 bits, assuming the human can work out the most likely mistake as in your example, and we assume it's a simple error like a nearby key or simple character flip. If it's a random password, it may still leave 2-3 bits per character as it becomes much harder to know where the error is (e.g., if "j9^vl4JO" is wrong, what is the correct password?), but if you have your hands on two independent errors, which is reasonably likely, that pretty much collapses to 1-2 bits tops even in the random case (e.g., if you also have "k9^vl4JP" that pretty much nails it down to either the first and last being "j P" or "k O"). It is a truly terrible idea!
- xoa 7y ago>e.g., if "j9^vl4JO" is wrong, what is the correct password? Shouldn't that remain utterly trivial to brute though? If we're assuming all the standard face keys+shifted, I think that's 94 characters. If it's fully unknown then search space is 94^8 or about 6E15, not good but if it's an adaptive hash sizable. But if it's only a one character error, wouldn't you just brute through each of the 8 one by one with only 94 each? That'd reduce it to just 752 possibilities at worst which is so low someone determined could even do it by hand, even ignoring any obvious psychology like the likelihood that the special character isn't the mistake and probably the only special character too. Certainly not quibbling that it's an awful idea. I don't even like "password hints" so many systems still seem to have, they should be random!
- berbec 7y agoInterestingly enough, this password does not show up on haveibeenpwnd!
- toolslive 7y agodisappointed he didn't use algebraic notation. Could have been: e4e5f4ef
- inetsee 7y agoWouldn't that be easier to crack, since it doesn't have any special characters?
- abjKT26nO8 7y agoAnd it would be easier to crack this way.
- CrazyStat 7y agoAlgebraic notation wasn't in common use in the US until the 80s. 3BSD was released in 1979.
- phonebucket 7y agoThompson is a person of class, hence opening with the queen's pawn. The Kings Gambit accepted is too brutish.
- floatingatoll 7y agoIf you can find a good link about why algebraic notation is better, it would make an excellent HN post of its own today.
- sergers 7y agoBut then he would have a more easily crackable password
- MadWombat 7y agoQueen's pawn, so d4d5e4de
- toolslive 7y agoreal men play the King's gambit ;)
- octosphere 7y agoI use a diceware[0] passphrase for my Keepass database. I was inspired heavily by XKCD comic 936[1]. My only issue with password managers is that they are a single point of failure and are juicy targets for hackers, so I usually vet them and audit them thoroughly before I use them. I am one of those rare people that actually looks at the source code of password managers to look for flaws in the implementation (I sometimes spot flaws and duly report them to the maintainers). One caveat to diceware I never liked is how it wears out the keyboard over time as you have to type the same passphrase each time to open the vault (You would be surprised how many times I need to do this each day). I sometimes have to lock my database to avoid evil maid attacks when in a hotel for example. Of course I go through about three keyboards a year because of this, but I don't mind the cost if it gives me a crispy fresh keyboard each time. And did I mention I don't own merely one encrypted database, but many depending on different contexts and different devices? [0] https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware [1] https://www.xkcd.com/936/ https://www.xkcd.com/936/
- Twixes 7y agoYour switches/keycaps must be kind of crappy if there's that much wear on them from typing the same thing often
- sfink 7y agoSo you're saying that if I get access to your current keyboard or any of your former ones, I can get all of the keys used in typing your master password just by looking at the wear pattern? Hey, thanks for the tip!
- MayeulC 7y agoI guess you could switch keycaps at a much lower cost, depending on your keyboard model. If those are blank, randomly shuffling them around might be enough as well (if you can do without the new keyboard, and don't think that an attacker would look at the keyswitches wear. This is also something I see quite often on mobile phones with a pin/pattern unlock: you can often infer the pin from the wear pattern, or the grease marks on the screen if the phone was used recently. My keycap wear pattern more or less mirrors the letter frequency in the languages I write.
- lolc 7y agoThis bothers me because I prefer to use slightly embarrassing passphrases. I do that because it creates a secondary incentive not to disclose them.
- elisto 7y agoDoes that mean that it is embarrassing and can be tied to you or that it is just embarrassing to say? If the first, then wouldn't you risk being pwned and having that used against you?
- xnyan 7y agoI’m guessing the latter. Not saying my password is 8o0b7fOr2060+9
- mjlee 7y agoI worked with someone who had to share a password to solve a major outage. (Yes, I know...) It was a rude comment about a colleague.
- lolc 7y agoWant better password hygiene in the workplace? Encourage rude passwords!
- lolc 7y ago
- jonnycomputer 7y agothe most amusing thing is the exclamation mark on such a banal opening move.
- Waterluvian 7y agoIt's been decades. That means "Check!" right?
- andrepd 7y agoNope, it means "good move". Check is +
- deleted 7y ago[deleted]
- thom 7y agoExclam! Generally a good move, perhaps even unexpectedly so. Double exclam, !!, being a brilliant move, especially one with flair like a sacrifice. Triple exclam is reserved for the games of Emory Tate. ;)
- mongol 7y agoEmory Tate must have been extraordinary..?
- mywittyname 7y agoMore like Extraordinary!!!
- paulddraper 7y agoIt's similar to English actually. It's commentary, rather than semantics. ! is good move. ? is dubious move. If you want to carried away double/triple those.
- arnsholt 7y agoAt least in modern usage, giving the exclam to signal "I prefer this opening move" isn't uncommon, so it's not a stretch to think that it was done in the seventies too. Also it rounds the whole thing out nicely to eight characters.
- thiagoc 7y ago"Now I need to change my password on all websites that I use >:/"
- giorgioz 7y ago>Did he really use uppercase letters or even special chars? (A 7-bit exhaustive search would still take over 2 years on a modern GPU.) >took 4+ days on an AMD Radeon Vega64 I don't understand. The author first claims that it would take 2 years on a modern GPU to brute force a 7 bit password with special characters but then he is helped by Nigel Williams that cracked it on 4 days on an AMD Radeon Vega64 Did Nigel Williams used a better technique? Is AMD Radeon Vega64 much faster than a "modern GPU"? Did the author overstimated the difficulty?
- politelemon 7y ago> (those familiar know the hash-rate fluctuates and slows down towards the end) Could someone explain this to me, why does it slow down towards the end?
- alex_duf 7y agoI'm curious too, could it be due to the way the search space is explored in parallel?
- parsimo2010 7y agoI don't know for sure, but these Radeon GPUs are power hungry and hot. It could be just that after multiple days the entire computer is heat soaked and goes through more thermal throttling than even the "steady state" GPU tests that most gamers do (a few hours). It might also be cruft building up over time with small memory leaks or imperfect memory management.
- nexuist 7y agoThis is what I thought too, the heat simply becomes overwhelming and the unit has to underclock to prevent melting.
- close04 7y agoI think the "towards the end" part is the misleading one. The software has no idea where the end is or it would just jump there. Since the run took 4 days slowing down due to throttling would happen pretty fast as the card reaches a thermal equilibrium. Certainly wouldn't take days to do it. It's more likely the explanation above of something (not heat) accumulating over time and slowing down the processing.
- floatboth 7y agoReal explanation below >> https://news.ycombinator.com/item?id=21205272 https://news.ycombinator.com/item?id=21205272
- deleted 7y ago
- Isamu 7y agoQueen's pawn game: https://en.wikipedia.org/wiki/Queen%27s_Pawn_Game https://en.wikipedia.org/wiki/Queen%27s_Pawn_Game [edit] See also "Ken, Unix and Games" by Dennis Ritchie: https://www.bell-labs.com/usr/dmr/www/ken-games.html https://www.bell-labs.com/usr/dmr/www/ken-games.html
- frou_dh 7y agoHe would have had to expend quite some calories to type that out every time on an ancient keyboard with chunky keys and massive travel.
- floatingatoll 7y agoUphill! Both ways! How many fewer calories do I burn when typing on a low-travel keyboard rather than an old mainframe keyboard?
- CDSlice 7y agoProbably not very many. According to XKCD What If? [1] a modern keyboard takes around 2 millijoules to press a key. Typing a full novel would take a few kilojoules. Even if an old mainframe keyboard took 10x more power to press the keys you would save less than a AA battery worth of energy over writing a full novel. [1] https://what-if.xkcd.com/102/ https://what-if.xkcd.com/102/
- floatingatoll 7y agoUsing some conversions from an internet site, one AA battery is 1.3e4 Joules and a human requires 8.4e6 Joules per day, so about 133 seconds of energy saved per 6 months of novel, or two lost seconds of calorie burning exercise every three days. (Lots of sketchy napkin math here)
- aasasd 7y agoI can just say that attempting to even begin learning to play bass guitar had me exercising the fingers for two–three hours before they stopped feeling like wooden sticks on the strings. Almost every day. I.e. mashing the keyboard is no workout at all. This means, however, that a typewriter would likely noticeably exhaust a modern keyboard jockey, though not in eight characters (hopefully). But dunno about teletypes.
- 1123581321 7y agoI don’t understand why the author thought it would take years to find this password, as opposed to something closer to the four days it actually took.
- sp332 7y agoThey said an exhaustive 7-bit search would take that long. Edit: That would be 128^8 =~ 72 quadrillion DES hashes.
- aidenn0 7y agoWhich works out to 2.2 years at the rate that the actual password was cracked (1GH/s).
- Aissen 7y agoThat's the probabilistic aspect of password cracking :-). In addition, I'm not sure if it's 2 years with 2014 GPUs (when he did the initial cracking), or today's GPUs.
- deleted 7y ago[deleted]
- wibble10 7y agoI’m sort of curious what dmr’s was now (his hash is gfVwhuAMF0Trw) from the same dump...
- Miner49er 7y agoLooks like it was dmac https://inbox.vuxu.org/tuhs/87bluxpqy0.fsf@vuxu.org/ https://inbox.vuxu.org/tuhs/87bluxpqy0.fsf@vuxu.org/
- JoeAltmaier 7y agoI had a password for an old school system (which I wrote) that was "any 21 characters where the 21st character is a 'z'". People would watch me type it (mashing 20 keys then the 'z') and be amazed I could remember a password that long.
- dev_dull 7y agoSuch a funny idea. I’d would have loved to see people’s faces when you typed it in.
- cellular 7y agoYou password is "the21stcharacterisa'z"
- Razengan 7y agoHey that's actually a neat idea! You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters. So people could type in different gobbledegook each time between the characters that matter. To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters. So, if my password is: Any 8 characters, but 2nd character must be A/B/C/x/y/z, and the 6th must be !/@/# then I could type: 9A4jc@23 #C(@$!as oxo!c#-1 or any other valid combinations to get in. How more secure would something like that* generally be compared to static passwords? * (Of course this is a simplified example for illustration. In practice you'd use more characters/options.)
- jedberg 7y ago> How more secure would something like that generally be compared to static passwords? It's not secure at all. If someone knows the rules of the system, the entropy on that is tiny, because it's basically a 2 letter password with only 6/3 options. The only security would be from the obscurity of the attacker not knowing the password rules.
- Razengan 7y ago> because it's basically a 2 letter password with only 6/3 options. That was obviously an oversimplified example to explain the rules. In practice you could make it as obscure as you want, while keeping it easy for you to remember. Like the sentences I just typed here. No limit on the number of characters. I could enter different long sentences each time, as long as the characters at specific positions match certain sets.
- abalone 7y agoHow did they crack it in 4 days if ”a 7-bit exhaustive search would still take over 2 years on a modern GPU”? Is that overstating it?
- maccard 7y agoThey got lucky/narrowed the search space. Just because it will take me 2 years to evaluate all the possibilities, doesn't mean I won't immediately hit aaaaaaaa
- semi-extrinsic 7y agoSpecifically, we can conjecture they narrowed the search space to "lowercase+numbers+a few symbols", excluding uppercase letters.
- MayeulC 7y agoI guess that cracking this specific password could be said to have been parallelized over multiple individuals over the years, and it wouldn't surprise me if it had burnt multiple years of processor time. In the end, someone had to get lucky when picking their search space/exploration parameters :-)
- deleted 7y ago[deleted]
- jedberg 7y agoBack when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it. If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed them their password in plain text using our internal email system. Jury's still out on whether that was a good idea. :) The next week we just disabled your account and you had to come to IT to fix it. One guy actually got fired for his password. He was already being super creepy and making the girl who sat across from him uncomfortable, but she never told anyone. Then we cracked his password, which was a very naughty phrase about the girl who sat across from him. I reported it to HR, who asked the girl, who then said he was creepy, and so they acted swiftly on the reports and got him out of there.
- mongol 7y agoI don't know what to think about this. A password is supposed to be secret so I don't know what a naughty phrase in secret is a violation of? It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.
- CydeWeys 7y agoThe guy wasn't fired for the password, he was fired for the sexual harassment of a coworker. And nothing you do on a work computer is secret from your employer. It's not a "private diary" if you're using your employer's hardware.
- mongol 7y agoIf he was fired for sexual harassment, that is one thing. But a naughty password on its own? That was maybe not the case here but that is what I have doubts about.
- swampthinker 7y ago
- umanwizard 7y agoIf anyone is curious, the equivalent in modern notation is “1. d4!”. Moving the pawn in front of the queen forward by two spaces. The exclamation point indicates that the annotater believes it to be a particularly strong move (describing a standard move from opening theory that way is a bit tongue-in-cheek).
- sanderjd 7y agoWhat does the p/ part mean? My chess experiences is all after the popularity of descriptive notation...
- gatesphere 7y agop/q2-q4! p : pawn / : at q2 : queen's file, rank 2 - : moves to q4 : queen's file, rank 4 ! : good move!
- sanderjd 7y agoOh hmm, I didn't realize the notation was so unnecessarily verbose :) Of course it's a pawn moving from q2 to q2, that's the only thing there at the beginning of the game!
- rimliu 7y agoPawn?
- blub 7y ago
- annoyingnoob 7y agoI'm feeling like it is not appropriate to publicly post passwords, even when they are old.
- lonelappde 7y agoThis is Vader is Luke's father old.
- iblaine 7y agoThis brings back memories of a common exploit w/tftp, such that you could download an unshodowed /etc/passwd file from a remote machine, decrypt it, log into that remote system, collect new hosts from /etc/hosts, then rinse and repeat. Hash rate were pretty slow back then, but the fact that people used passwds straight out of dictionaries helped, so I'm told...
- wjp3 7y agoBetter yet, open the /etc/passwd and see the root user's password wasn't set... Back in college I ran ToneLoc overnight and would try ftp on the successful hits. One server didn't have root set, so I telnet'ed, <Enter> when prompted for the password, and I was in. I ran 'who', saw a user logged in. Decided to wall them a message of "You should really set your root password." and logged out. A couple of days later, I got an email on the trash email account I would use for ftp logins - dude was super nice but freaked out and wanted to know how I found his server. I didn't reply.
- nguoi 7y agoDo you know the train biscuits story? https://www.youtube.com/watch?v=SF2fZ2iOXhk https://www.youtube.com/watch?v=SF2fZ2iOXhk Imagine the anecdote coming from the person you wall'd.
- bryanrasmussen 7y agoThat password was pretty long - could be a complete windowing system written in J.
- soohyung 7y agoThe password is only the last 8 characters, everything before the colon is the password's hash.
- bryanrasmussen 7y agoI'm certainly not going to let reality get in the way of a joke about the compact expressiveness of J.
- pailander 7y ago"The password is not found in any known data breaches. It should be safe to use". Ok... https://imgur.com/a/TTWME6G https://imgur.com/a/TTWME6G
- pailander 7y agohttps://imgur.com/a/TTWME6G https://imgur.com/a/TTWME6G Safe to use!
- Zanneth 7y agoDid anyone bother to ask Ken’s permission first before publishing his password on the public internet? Based on his reaction he clearly didn’t mind, but still!
- blub 7y agoIn my opinion this was a pretty crappy thing to do. Password could contain personal and potentially embarrassing information, even if that wasn't the case here.
- PacketPaul 7y agoNow I know his chess move.
- pbhjpbhj 7y agoRevealing people's internet pawn habits shouldn't be done lightly ... /dadjoke
- ben509 7y agoPike was piqued, too.
- emmelaich 7y agoHere's his message. Says he knew it already by sitting near Ken. https://inbox.vuxu.org/tuhs/CAKzdPgw0Vz8UFbK7c_Jr+RHGMssSxN=t8W36J0FMTPt5w+wkgA@mail.gmail.com/ https://inbox.vuxu.org/tuhs/CAKzdPgw0Vz8UFbK7c_Jr+RHGMssSxN=...
- zamadatix 7y agoThis was a crappy thing to do even though the reason it is crappy wasn't the case here?
- bakul 7y agoThe /etc/passwd file from which this password was unearthed has a date of Jan 5 1980 (from a 3BSD tar file). Presumably ken has updated his password since then.
- deleted 7y ago[deleted]
- usebunsby 7y agoHmm. That's interesting.
- reubensutton 7y agoI wonder how long it was between this password crypt approach and the first practical cracker for them
- bobwaycott 7y agoI’m slightly confused by the part where the author states a 7-bit search would take 2 years on a modern GPU, and the answer was found in 4 days on a Vega64. Isn’t that a modern GPU? Have I misunderstood here, or was the author’s math incorrect?
- stevewodil 7y agoIt would take two years to generate every hash, but this one happened to be generated earlier than that. It would also be technically possible to guess a Bitcoin address private key on the first guess, but there are 2^160 total possibilities
- quickthrower2 7y agoTroy, please add this breach to https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
- ganitarashid 7y agoI guess he’s lucky that the password wasn’t anything embarrassing. What if the password had been “I love sex” or something?
- deleted 7y ago[deleted]
- whalesalad 7y agoI remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crack. It was so simple that for weeks I didn’t even believe it to be true, and didn’t realize the name of the account was an admin. I was expelled a few months later for all the fun I had after discovering this. Good times.
- passivepinetree 7y agoThat's fascinating. Would you mind sharing the full story?
- blackflame 7y agoI was also expelled for basically doing the exact same thing. Exploiting cached domain admin passwords for Novell via a local SAM file. NTLM hashing does something incredibly dumb for legacy purposes by splitting passwords longer than 7 letters into multiple hashes for the first 7 letters and the second 7 letters. We got caught because a kid left a flash drive with teachers passwords in a computer lab and when the teacher tried to find out who the drive belonged too, he found that kids homework and his own password. There's some news stories that came from it: https://www.sandiegouniontribune.com/pomerado-news/sdpn-rbhs-students-suspended-in-computer-hacking-probe-2008apr30-story.html https://www.sandiegouniontribune.com/pomerado-news/sdpn-rbhs... https://www.sandiegouniontribune.com/sdut-poway-letter-to-staff-implicates-more-students-in-2008may02-story.html https://www.sandiegouniontribune.com/sdut-poway-letter-to-st... https://www.latimes.com/archives/la-xpm-2008-may-13-me-briefs13.S3-story.html https://www.latimes.com/archives/la-xpm-2008-may-13-me-brief... https://www.kpbs.org/news/2008/apr/29/officials-investigate-local-high-school-cheating/ https://www.kpbs.org/news/2008/apr/29/officials-investigate-...
- qzx_pierri 7y agorighteous
- quickthrower2 7y agoSerious question: Was this illegal to crack?
- qrbLPHiKpiux 7y agoDave MacArt, computer science teacher, high school Username Mac Passwd Cam Easy brute force in 1989 I got in big trouble for it because I messed up the server.
- ectospheno 7y agoI once anonymously emailed administrators of a multiuser unix system that perhaps they should handle the numerous users that had home directories and .bashrc files that were both writable by everyone. After a week I had the users themselves email when they logged in. It was fixed that day.
- cantrevealname 7y agoOne lone password from the original list, Bill Joy's password, is still uncracked as far as I can tell. Bill Joy is the co-founder of Sun Microsystems, author of vi, and a key developer of BSD UNIX. He apparently picked the best password. Here's the /etc/passwd entry: bill:.2xvLVqGHJm8M:8:10:& Joy,4156424948:/usr/bill:/bin/csh
- Snawoot 7y agoI already checked all passwords made of any printable character up to 7 symbols length. Full 8-symbol bruteforce will take about 120 days on my hardware, so I prioritized passwords with no special symbols first. Does anyone with hashcat and GPGPU want to join me?
- Snawoot 7y agoPreimage found and about to be disclosed: https://inbox.vuxu.org/tuhs/90ffe509-76b5-6629-c55a-7785815fda2e@kilonet.net/ https://inbox.vuxu.org/tuhs/90ffe509-76b5-6629-c55a-7785815f... And yes, again it is related to chess.
- royce 7y agoIt's now been cracked - and now we know why it took so long: https://minnie.tuhs.org/pipermail/tuhs/2019-October/019124.html https://minnie.tuhs.org/pipermail/tuhs/2019-October/019124.h...
- trustissue 7y agoSpeaking of passwords, I just discovered that HN will ban your IP address from creating an account if you have a question mark in your password. I assume this is to help against SQL injection? (Not a security person here.) Pretty extreme result, but luckily I can post from another IP. I wonder how many users have hit this and not known why?
- grzm 7y agoWhile possible, it seems unlikely that this is the case. I'd contact the mods via the Contact link in the footer to resolve the issue.
- elahieh 7y agoZghOT0eRm4U9s is actually the newer one, the older one is from 2.9BSD, through to 4.3BSD https://www.openwall.com/presentations/Passwords12-The-Future-Of-Hashing/mgp00011.txt https://www.openwall.com/presentations/Passwords12-The-Futur... sq5UDrPlKj1nA Seeing this news, I guessed this one on my second guess (after trying p/q2-q4!) - no brute forcing required! p/k2-k4!
- elahieh 7y agoOops - I have it the wrong way around. 2.9BSD came out after 3BSD.
- rcpt 7y agoThat url, http://www.retrocomputingtasmania.com http://www.retrocomputingtasmania.com
- AdamN 7y agoSeems like an annoying password to type.
- cantrevealname 7y agoSince this password list appears to come from one of the original systems on which UNIX and C were developed, it would be fun to see the names and original passwords of all the luminaries. I merged together the author's work, the original /etc/passwd, and the comments from the mailing list: root:OVCPatZ8RFmFY:Ernie Co-vax --> cowperso daemon:*:The devil himself --> (login not allowed) bill:.2xvLVqGHJm8M:Bill Joy --> (password still unknown) ozalp:m5syt3.lB5LAE:Ozalp Babaoglu --> 12ucdort sklower:8PYh/dUBQT9Ss:Keith Sklower --> theik!!! kridle:4BkcEieEtjWXI:Bob Kridle --> jilland1 kurt:olqH1vDqH38aw:Kurt Shoens --> sacristy schmidt:FH83PFo4z55cU:Eric Schmidt --> wendy!!! hpk:9ycwM8mmmcp4Q:Howard Katseff --> graduat; tbl:cBWEbG59spEmM:Tom London --> ..pnn521 jfr:X.ZNnZrciWauE:John Reiser --> 5%ghj mark:Pb1AmSpsVPG0Y:Mark Horton --> uio dmr:gfVwhuAMF0Trw:Dennis Ritchie --> dmac ken:ZghOT0eRm4U9s:Ken Thompson --> p/q2-q4! sif:IIVxQSvq1V9R2:Stuart Feldman --> axolotl scj:IL2bmGECQJgbk:Steve Johnson --> pdq;dq pjw:N33.MCNcTh5Qw:Peter J. Weinberger --> uucpuucp bwk:ymVglQZjbWYDE:Brian W. Kernighan --> /.,/., uucp:P0CHBwE/mB51k:UNIX-to-UNIX Copy --> whatnot srb:c8UdIntIZCUIA:Steve Bourne --> bourne finger::The Finger Program --> (no pw but runs a program, not a login shell) who::The Who Program --> (no password but runs a program, not a login shell) w::The W Program --> (no password but runs a program, not a login shell) mckusick:AAZk9Aj5/Ue0E:Kirk McKusick --> foobar peter:Nc3IkFJyW2u7E:Peter Kessler -- ...hello henry:lj1vXnxTAPnDc:Robert Henry --> sn74193n jkf:9ULn5cWTc0b9E:John Foderaro --> sherril. fateman:E9i8fWghn1p/I:Richard Fateman --> apr1744 fabry:d9B17PTU2RTlM:Bob Fabry --> 561cml.. network:9EZLtSYjeEABE:(no name listed) --> network (runs a program, not a login shell) tty:: --> (no password but runs a program, not a login shell) It's amusing to see that even very smart people picked passwords just like people do today: - spouses' names (jilland1, wendy!!!, sherril.) - birth dates (apr1744 might be April 17, 1944) - the first word that came to your mind (whatnot, foobar, ...hello) - though a few were thoughtful (sn74193n is a synchronous binary counter from the 7400-series chip family and likely immune to dictionary attack in that era) - easy to type patterns on a keyboard (/.,/., or 5%ghj) - obscure words (axolotl is a Mexican walking fish) - different languages (12ucdort is 1,2,3,4 in Turkish) - and some people didn't care (Steve Bourne, inventor of the Bourne shell, picked "bourne")
- royce 7y agoThe superset of all of the original CSRG-shipped cracking-eligible descrypt hashes is actually about 1400 hashes, drawn from a slightly smaller number of overlapping accounts among releases. Many of them appear to have been temp/test/throwaway with generic usernames and short, simple passwords.
- scardine 7y agoRight after finishing Electronics vocational school I spent the next year working as an intern at Unicamp (Campinas University in Brazil). The job was at the computer lab of the School of Electrical and Computer Engineering[1]. This was before ethernet (yeah, I' that old), so dumb terminals were linked to the CPUs through RS-232 cables - when I was not burning my fingertips soldering DB-25 connectors I was tinkering with every computer I could get my hands on. I saw /etc/passwd and asked my boss how to decrypt the passwords. He told me it was a one-way encryption, so the login program would just encrypt the password you provided and compare to the encrypted value. He went on explaining the old crypt algorithm and even made a bet I could not guess his password. He said it was related to a movie. So at 17 I was hooked and started studying the sources. In the end I just patched and recompiled the passwd binary to store clean text passwords in a hidden file. Later I learned this was called a trojan horse. And even now, 30 years later, I remember his face when I told the movie was Citizen Kane and his password was "rosebud". Thank you Miguel and Gorgonio for teaching me about C and Unix! This knowledge paid my rent for 3 decades and I still love the job. [1] http://www.internationaloffice.unicamp.br/english/teaching/graduate/school-electrical-computer-engineering/ http://www.internationaloffice.unicamp.br/english/teaching/g... [2] https://en.wikipedia.org/wiki/RS-232 https://en.wikipedia.org/wiki/RS-232
- tracker1 7y agoInterresting. :-) When I create hashes for systems, I actually, now create a "version" prefix for hashes... this way I can on-run upgrade to a newer hash at login (if/when needed). Have upgraded a older systems this way... after 30 days, dumped any that hadn't changed and sent emails notifying that they'd have to use the "forgot password" option the next time they wanted to login. Currently using pbkdf2/hmacsha512*100000 for password hashing. 16-byte salt, 32byte result... varying too far from NIST guidelines would have been a hard sell. output base64 values: v#.SALT.HASH
- tiep 7y agoi'm interesting with this, have an copy for it
- dataminded 7y agoReminds me of when I cracked the domain admin account at work so that I could install software that I needed to do my job. IT was slow and unresponsive so I figured that I would help them.
- tempodox 7y agoDigital archaeology has always been an interest of mine. Must be fascinating to investigate such antique artifacts.
- mikorym 7y agoSurely this was a perhaps modified dictionary attack that solved it in the end? I don't understand the comments that describe (presumably random) 10+ char passwords as "crackable".
- tejisanti_ 7y agoDear stargrave, I am very grateful for sharing this knowledge. It was a delight reading.With this, I realized I am almost achieving a old dream of mine since my teenager years: I understood almost everything. And came in the proper time, just as I am finishing my masters in informatics and computer engineering this year. You have my gratitude.