4 ms·

Back in the AOL days, I couldn't afford internet as a teenager. Well that problem was easily solved. There was some software that would use windows API to iter

Back in the AOL days, I couldn't afford internet as a teenager. Well that problem was easily solved. There was some software that would use windows API to iterate public chat rooms listbox and collect screen names for later use. After that list was pretty full and both parents went to work, the magic happened: each dial into AOL allowed 3 attempts at login before it would hang up. Adding *67 to each AOL dial maybe prevented it from banning the incoming calls? There were no password rules back then, this software would try the letters and numbers from the screen name along with asdf, love, monkey, etc. If I got lucky, there would be a fresh account or two to use until the owner couldn't login and changed their password. This worked until I could afford my own connection. It taught me VB6 in the process. Fun times.

ry4nf 3y ago
AOL had some crazy password vulnerabilities. For awhile "12345678" would validate if your password was actually 1234, 12345, 123456, 1234567. So that means you could speed up your cracking by removing some of those shorter passwords from your list. Another I remember was for awhile(99-2000ish?) you could change your password and old passwords still worked. I don't know how long it took AOL to fix those but at least a few months for each one from the time I found out about them. If you first connected to another dialup company like Earthlink you could then change AOL's connection settings to TCP/IP instead of dialup which let you go from the AOL sign-in window to completely logged in just in a few seconds. That means you could skip the entire dialup process when having to re-connect to AOL after either getting a successful crack or disconnected from the guest login screen for too many invalid guesses. Later on some guys figured out how to make "winsock crackers" that were actually really fast but would get patched when too many people started using the different methods people were finding.
- Dylan16807 3y ago
  > AOL had some crazy password vulnerabilities. For awhile "12345678" would validate if your password was actually 1234, 12345, 123456, 1234567. So that means you could speed up your cracking by removing some of those shorter passwords from your list. I wouldn't call that a vulnerability, even if lets you attack passwords 2% faster.
  - ry4nf 3y ago
    Yeah I don't know what it would be called but it was a nice trick for the type of cracking like was being described by harvesting names out of public chats. People normally used short password lists with variations of a lot of common things when they were trying running a list of thousands of names to crack. No clue exactly how much it improved hit rates or speed but I remember being it helpful for sure

ry4nf 3y ago

AOL had some crazy password vulnerabilities. For awhile "12345678" would validate if your password was actually 1234, 12345, 123456, 1234567. So that means you could speed up your cracking by removing some of those shorter passwords from your list. Another I remember was for awhile(99-2000ish?) you could change your password and old passwords still worked. I don't know how long it took AOL to fix those but at least a few months for each one from the time I found out about them. If you first connected to another dialup company like Earthlink you could then change AOL's connection settings to TCP/IP instead of dialup which let you go from the AOL sign-in window to completely logged in just in a few seconds. That means you could skip the entire dialup process when having to re-connect to AOL after either getting a successful crack or disconnected from the guest login screen for too many invalid guesses. Later on some guys figured out how to make "winsock crackers" that were actually really fast but would get patched when too many people started using the different methods people were finding.

Dylan16807 3y ago
> AOL had some crazy password vulnerabilities. For awhile "12345678" would validate if your password was actually 1234, 12345, 123456, 1234567. So that means you could speed up your cracking by removing some of those shorter passwords from your list. I wouldn't call that a vulnerability, even if lets you attack passwords 2% faster.
- ry4nf 3y ago
  Yeah I don't know what it would be called but it was a nice trick for the type of cracking like was being described by harvesting names out of public chats. People normally used short password lists with variations of a lot of common things when they were trying running a list of thousands of names to crack. No clue exactly how much it improved hit rates or speed but I remember being it helpful for sure