4 ms·

I'm disappointed that it followed a pattern like that, since that's supposed to make it easier to brute-force guess.

floatingatoll 7y ago
It seems likely that someone will write an archaic chess notation pattern engine into the crackers now that this has been discovered and shared widely.
henrik_w 7y ago
I agree, but didn't seem to help in this case though :-)
lucb1e 7y ago
Yes, any sort of logic is weaker than random characters. But this was a long long time ago, hence the weak passwords. Computers couldn't crack things that fast. Today, recommendations are still based on what we expect computers will be able to crack in the foreseeable future. I remember a teacher used the password "music". We had every user's password in plaintext. This was useful when installing a new Windows domain controller and setting all the passwords (about 30 employees in the school) instead or copying hashes or letting them set their own passwords. In hindsight, I find it batshit crazy that some stupid intern (me) walked around the school with a sheet of paper with literally everyone's password on it, logging into people's systems where necessary or potentially forgetting the sheet somewhere. I'm not saying this never happens anywhere in the world anymore, but I do think security mindset changed in the last decades.
- tom_mellior 7y ago
  On the other hand, being admin on a system is not that different. Sure, you don't have users' passwords, but you can still do arbitrary stuff in their name. Very large organizations will have some sort of system that logs this stuff and that you can't tamper with, but in a lot of places you could easily cover your tracks.
  - UI_at_80x24 7y ago
    Edward Snowden would agree.
  - lucb1e 7y ago
    I would argue that having passwords made up by users and having access to a user's work account is a little different. In the former case, I see what kind of password they use and can guess that they reuse the password (or a variant) elsewhere. I can also take knowledge if I get fired, but my admin permissions are revoked.
- sonofgod 7y ago
  circa 1995: Teacher had password written on the BACK of the clipboard they carried around everywhere. Said teacher's password was 'qwerty'. (Yes, it worked)

It seems likely that someone will write an archaic chess notation pattern engine into the crackers now that this has been discovered and shared widely.

henrik_w 7y ago

I agree, but didn't seem to help in this case though :-)

lucb1e 7y ago

Yes, any sort of logic is weaker than random characters. But this was a long long time ago, hence the weak passwords. Computers couldn't crack things that fast. Today, recommendations are still based on what we expect computers will be able to crack in the foreseeable future. I remember a teacher used the password "music". We had every user's password in plaintext. This was useful when installing a new Windows domain controller and setting all the passwords (about 30 employees in the school) instead or copying hashes or letting them set their own passwords. In hindsight, I find it batshit crazy that some stupid intern (me) walked around the school with a sheet of paper with literally everyone's password on it, logging into people's systems where necessary or potentially forgetting the sheet somewhere. I'm not saying this never happens anywhere in the world anymore, but I do think security mindset changed in the last decades.

tom_mellior 7y ago
On the other hand, being admin on a system is not that different. Sure, you don't have users' passwords, but you can still do arbitrary stuff in their name. Very large organizations will have some sort of system that logs this stuff and that you can't tamper with, but in a lot of places you could easily cover your tracks.
- UI_at_80x24 7y ago
  Edward Snowden would agree.
- lucb1e 7y ago
  I would argue that having passwords made up by users and having access to a user's work account is a little different. In the former case, I see what kind of password they use and can guess that they reuse the password (or a variant) elsewhere. I can also take knowledge if I get fired, but my admin permissions are revoked.
sonofgod 7y ago
circa 1995: Teacher had password written on the BACK of the clipboard they carried around everywhere. Said teacher's password was 'qwerty'. (Yes, it worked)