I would have borrowed &quot;&#x2F;.,&#x2F;.,&quot; a long time ago had I heard about it sooner. That is just way too convenient.

You often had to share your password in the real world.  I&#x27;ve worked on systems where you were only allowed to login at one terminal at a time.  If you are back and forth from your desk to the lab it is nice to know another password when you forget to logout in one location.

In the early days of unix, people didn&#x27;t take passwords that seriously and often shared them.

In fact, the system where the password originates from (3BSD) was released in 1979 and had commands like net(1) for &quot;execute a command on a remote machine&quot; - given a password was provided. Since quite the early days Unix has been designated as a multi-user time-sharing OS for large expensive computers.

I guess, to enter the Unix password you need physical access to a machine. If they have access to a machine and can crack a lowercase password, a harder password will not necessarily save you. So at least you can make it easier for you to type.

In the future, there won&#x27;t be any need for passwords.

you&#x27;re confusing mainframes with UNIX microcomputers, and 1983 wasn&#x27;t early.Also, I rememebr when FSF hosted UNIX machines at MIT that you could telnet into without a password. It was a total mess.

The early days of mainframes had some groups of individuals who advocated for no passwords or just your username again as a password: <a href="https:&#x2F;&#x2F;www.oreilly.com&#x2F;openbook&#x2F;freedom&#x2F;ch07.html" rel="nofollow">https:&#x2F;&#x2F;www.oreilly.com&#x2F;openbook&#x2F;freedom&#x2F;ch07.html</a>

Stupid question but how do you actually type on that thing? I don&#x27;t see anything resembling a keyboard.

Typing on a teletype is painful at the best of times. One reason why common Unix commands are so short.Edit: Yes I have used a teletype, connected to an Elliott computer, I believe it was a 903 or at least it looked very much like this: <a href="http:&#x2F;&#x2F;www.computinghistory.org.uk&#x2F;det&#x2F;32480&#x2F;Elliott-903" rel="nofollow">http:&#x2F;&#x2F;www.computinghistory.org.uk&#x2F;det&#x2F;32480&#x2F;Elliott-903</a>

&gt; Did he really use uppercase letters or even special chars?Why would he not? I&#x27;m obviously missing something here.

That&#x27;s funny - I was going to post that I was first exposed to this thirty years ago when my password was cracked on an old Sun computer! I didn&#x27;t complain, it was a wake up call. (You weren&#x27;t at OUCS were you?)

I remember in middle school using &quot;arena&quot; as a password.&quot;No one will ever guess this!&quot;

Ah, I remember doing that. Not quite 30 years ago, but jeez, getting close. Funny, it helped me remember some of the professor&#x27;s wives names, and for some reason I can remember the husband-hunting Italian lady&#x27;s password (amici) while I&#x27;ve forgotten both her name, her thesis project and everything else about her.It was actually decently well received by the department head; he sent out a memo to the staff to not use their wives names for emails and looked like an early computer security innovator in the physics department.

I got myself and my best friend in high school fired from a fairly good gig because I cracked some dumb passwords and a CEO took it the wrong way.  I still don&#x27;t think he fully forgave me for it.

30 years ago you could just sniff the passwords on the local subnet because everyone was using telnet and ftp in the clear.

This must have been a popular pastime in the 90s as I did the same thing for my university&#x27;s security on their new, centralized student accounts server. This effort was further aided by there being a predictable salt used for the password hashes that indicated which passwords were still set to the (again, predictable) default pattern. They were kind not to kick me out and not fire me as I was both a student and part time employee in their networking services department.

Inherited a system at current (for a few more weeks) employer (recently written so no excuse) that had used a weak hash for the password, I pointed out to my boss how bad it was and that it shouldn&#x27;t have happened, he didn&#x27;t pay a great deal of attention.So I threw the OpenMP variant of John the Ripper at it (I&#x27;d just built a 8C&#x2F;16T Ryzen machine and was curious) it broke ~80% of the passwords in under an hour and all of them over an afternoon of not been in use.Went to see the boss and gave him the list of passwords including his (which was one of the weaker ones) - he gave me the time to fix it and some other glaring security issues.The more things change the more they stay the same.I know enough about security to know that I really don&#x27;t know about security.

You can&#x27;t really blame them... it was called a pass &quot;word&quot;.

25 years ago I didn&#x27;t need to crack anyone&#x27;s unix passwords- they were all broadcasting them in cleartext every few minutes because they were using eudora or some other mail client, and I had converted an old sun workstation I found into a packet sniffer.

30 years ago I cracked everyone’s Unix password on an old Sun computer.It didn’t take long because everyone had a password that was in the dictionary.Needless to say, people were not happy with the messenger.

Doubt it. It took 4 days for just one top of the line GPU. Any dedicated attacker will have farms to parallelize it even further. It’s not exactly linear, but with just 4 GPUs (~$4000; well within the reach of any dedicated attacker), that’s one day. Not to mention the fact that GPUs have still been roughly following Moore’s Law in terms of performance.It’s probably safe from the casual attacker who just downloads a password list and runs a one word dictionary attack, but for a dedicated attacker, let alone a nation state, it’s not secure.TL;DR: Just use AES. Even an ASIC isn’t powerful enough for that. Searching the entire key space would take more energy than the universe has. Compare that to DES that can have its entire key space searched in a few days.[0]Edit: you said triple DES, not single. My point still stands. DES, even 3DES, is not secure. If I can crack a DES password in 4 days, I can crack a 3DES password in 12. AES with a strong password is virtually uncrackable.[0]: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;EFF_DES_cracker" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;EFF_DES_cracker</a>

This suggests you don&#x27;t understand how DES-based crypt() worked, so let&#x27;s take both angles here:1. Would it be safe to build a password hash like crypt() based on 3DES today?Maybe, kind of, it depends, don&#x27;t do this. &quot;Based on&quot; is key here. You&#x27;d have to come up with some way to try to use 3DES in this fashion, just as the developers of Unix crypt() used DES. Basically you&#x27;re trying to build a cryptographic hash out of a primitive that&#x27;s not really intended for that purpose, you also need to add more salt than the Unix team did back then, and then you need it to run very slowly, preferably on everybody&#x27;s hardware not just the generic (likely x86-64) general purpose CPU you&#x27;re using. Lots of people already built _good_ ways to do password hashing in the 21st century, and if none of those are available somehow you should just use PBKDF2 with SHA256 and a nice big iteration count and that&#x27;ll be tolerable.2. Oh, I didn&#x27;t realise, I just meant is 3DES fine for encryption?You should not do this. The main thing wrong with DES is the key size is too small, which 3DES fixes (effective key size with full 3DES is 112 bits, which is very short today but probably not the biggest hole in whatever security system you&#x27;re building). But the next biggest thing wrong with it is that it&#x27;s a block cipher with a small block size, 64-bits. 64-bits is small enough that bad guys may be able to collide your blocks and set fire to everything. To avoid this: Don&#x27;t use 64-bit block ciphers, go get a real cipher like AES that uses 128-bit blocks. Done. Why are you still here? Could it be secure if you can defuse the collision risk (e.g. you only encipher very small amounts of data)? Sure, but now you&#x27;re defining the problem to make the choice of primitive look safe, which is always a terrible idea.

Would this suggest that 3DES with a sufficiently long password is still safe for now?

&gt; But if the passphrase is already strong (6 random words from the Diceware wordlist), you can use MD5...Is this actually true? Note that you don&#x27;t need the actual password, just a hash collision.

Really it&#x27;s because of a mixture of the two. The traditional DES-based crypt is basically a really early KDF - it was intentionally designed to be slow in order to thwart brute-forcing attacks. (Of course, since it was based on the speed of late-70s computers and had a limited password length, it&#x27;s pretty feasable to brute force with modern hardware.)MD5 wouldn&#x27;t be invented for another decade or two...

&gt; I&#x27;m shocked at how well the old hashing stood up; sure, it&#x27;s totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkableIt&#x27;s not because the hash is strong, but the password itself is strong (if the attackers don&#x27;t know additional information about chess). The sole purpose of using a strong &lt;del&gt;hash or a&lt;&#x2F;del&gt; KDF on password is making low-entropy passphrase harder to crack by increasing the cost of every round, especially for cryptographic purposes. But if the passphrase is already strong (6 random words from the Diceware wordlist), you can use MD5, and I won&#x27;t be surprised if it takes one year to crack. Having 10 random words is guaranteed to be uncrackable under all circumstances, because it&#x27;s literally a 128-bit key.If your password has 80-bit of entropy, it makes even listing all possible passwords (without any hashing or encryption) a difficult job. Symmetric encryption works in a similar way, it&#x27;s secure not because of the computational resources it takes, but the number of possible keys it has.What is the moral of the story? Consider to use a password manager!

I hope this site is not fishing for passwords ...

And &quot;Good news — no pwnage found!&quot; On Troy Hunt&#x27;s <a href="https:&#x2F;&#x2F;haveibeenpwned.com&#x2F;Passwords" rel="nofollow">https:&#x2F;&#x2F;haveibeenpwned.com&#x2F;Passwords</a>Which shows that it is fairly strongly &quot;unique&quot;, since no-one else has used it and been pwned (or he hasn&#x27;t reused it and been pwned).

Yes - the 4 days is cool... you’d hope if some where had been hacked with your pass you would be notified within that timeframe

I&#x27;m shocked at how well the old hashing stood up; sure, it&#x27;s totally crackable today, but a well-picked password still took 4+ days to crack on modern hardware, which is remarkable. (Granted, it doesn&#x27;t sound like they did anything fancy like throwing a hundred cloud instances at it or something; I&#x27;m not saying you should use DES today:) )

still 13 characters...edit: LOL, I guess I&#x27;m a little dumb today

Honestly, that confused me too. I really thought the whole password was that long.

The part before : is the hash, the part after is the cracked 8 character password.

&gt;Since the DES-based crypt(3) algorithm used for these hashes is well known to be weak (and limited to at most 8 letters)&gt;ZghOT0eRm4U9s:p&#x2F;q2-q4!How is that 8 letters?

Uh, okay, technically true, touché.But it&#x27;s &quot;the beginning&quot; of roughly 50% of all chess games ever played. It seems very strange to call out one particular line it _might_ end up being the beginning of.It&#x27;s also &quot;the beginning&quot; of game 2 of the 1929 Bogoljubov-Alekhine world championship match, among millions of others, after all.

Pedantry might as well be correct: calling q2-q4 &quot;the beginning of a closed game&quot; hides the fact that it&#x27;s also the beginning of many other validated openings: <a href="https:&#x2F;&#x2F;en.wikibooks.org&#x2F;wiki&#x2F;Chess_Opening_Theory&#x2F;1._d4" rel="nofollow">https:&#x2F;&#x2F;en.wikibooks.org&#x2F;wiki&#x2F;Chess_Opening_Theory&#x2F;1._d4</a>Advancing the queen&#x27;s pawn 2 squares is a very common first move in chess at all levels. It&#x27;s disingenuous to call this the beginning of any one of the specific possible openings in the above list.

Not if you play chess. 1. d4 is played probably more than half the time in professional games. It can lead to lots of different openings, closed and open (but not at the same time).

Is it?  I mean, I&#x27;m not a chess expert, but can we actually call a chess game open or closed from only the first move?

Closed game is 1. d4 d5. There are quite a few opening lines that start with 1. d4, but do not continue into the closed game.

It is the beginning of the closed game, which is what the article says.Seems like a vacuous nitpick.

A slight nitpick with the article - `p&#x2F;q2-q4` (more commonly written as &quot;1. d4&quot; in modern times) is not the Closed Game, it&#x27;s just the first move of it. There are many, many other lines after 1. d4 besides just 1. ..d5, most of them quite open!

Uh oh. No 2FA? Definitely send him an email about that.

Here&#x27;s his Github account: <a href="https:&#x2F;&#x2F;github.com&#x2F;ken" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ken</a>

not a bad joke at all actually, but HN is just too far all up their own asses

I was able to log into his facebook and twitter accounts using that same password!Edit:
Ha ha, this is a bad joke!

He’s probably a bit peeved he has to use a new password. ;)

Each reply has its own page, just click next&#x2F;prev to follow the thread (or jump using the tree at the bottom)

I&#x27;d recommend finding a mailing list conversation about a topic you know and then hitting all the buttons (there are only a few).  you should be able to figure out the links from context

A decent email client will display these as a foldable hierarchy, sort of like HN or Reddit&#x27;s posting interface, just with the body of the posts hidden. With that and full text search it&#x27;s not so hard. It&#x27;s the web interfaces that are a bit bulky.

Many email applications can be set to a threaded view to be able to see who replied what to which message: <a href="https:&#x2F;&#x2F;support.mozilla.org&#x2F;en-US&#x2F;kb&#x2F;message-threading-thunderbird" rel="nofollow">https:&#x2F;&#x2F;support.mozilla.org&#x2F;en-US&#x2F;kb&#x2F;message-threading-thund...</a>

This is a common refrain, mailing lists do need a lot of instructions at the bottom to make sense — email wasn&#x27;t made for groups. It&#x27;s like &#x27;group&#x27; SMS, your phone might provide you with a single chat window with all your friends, but what it really is doing is just sending a separate SMS to every one of the recipients.So you need the &#x27;the manual&#x27; attached to every message to make sure people get it right. Looks downright scary sometimes though, especially the prospect of getting swiped at by UNIX greybeards if you do it wrong.Incidentally, I&#x27;m working on a modern version of this whole page in a Reddit-like interface. (<a href="https:&#x2F;&#x2F;aether.app" rel="nofollow">https:&#x2F;&#x2F;aether.app</a>) It doesn&#x27;t solve all of the pains of listserv, but it does help with most, including this one you mentioned.

You can use Google Groups as either a mailing list or via the web. It&#x27;s pretty handy and easy to administer if you don&#x27;t mind outsourcing that to Google.

For the most part, you wouldn&#x27;t use the web interface, which exists mostly for archival&#x2F;search-engine purposes.  You use a plain email program, and get used to hitting &quot;reply all&quot; instead of &quot;reply&quot; (this will have it be &quot;To:&quot; the person you&#x27;re replying to, and will &quot;Cc:&quot; the mailing list address), you send a regular email to the mailing list address when you want to start a new thread.  A halfway decent email program will thread the replies, like HN does.

The interface is email. You know how to use your email client, right?

As an internet old-timer, I initially thought this was a joke, but then realized that it&#x27;s entirely reasonable for a whole &quot;generation&quot; of internet users to grow up without using mailing lists, and that indeed they may seem scary at first!

Offtopic. Many teams use mailing lists. That UX always scared me. Is anybody know good tutorials on how to getting started to use this kind of interfaces?

Ken Thompson:&gt; congrats.<a href="https:&#x2F;&#x2F;inbox.vuxu.org&#x2F;tuhs&#x2F;CAG=a+rj8VcXjS-ftaj8P2_duLFSUpmNgB4-dYwnTsY_8g5WdEA@mail.gmail.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;inbox.vuxu.org&#x2F;tuhs&#x2F;CAG=a+rj8VcXjS-ftaj8P2_duLFSUpmN...</a>

It seems likely that someone will write an archaic chess notation pattern engine into the crackers now that this has been discovered and shared widely.

I agree, but didn&#x27;t seem to help in this case though :-)

On the other hand, being admin on a system is not that different. Sure, you don&#x27;t have users&#x27; passwords, but you can still do arbitrary stuff in their name. Very large organizations will have some sort of system that logs this stuff and that you can&#x27;t tamper with, but in a lot of places you could easily cover your tracks.

circa 1995:Teacher had password written on the BACK of the clipboard they carried around everywhere.Said teacher&#x27;s password was &#x27;qwerty&#x27;.(Yes, it worked)

Yes, any sort of logic is weaker than random characters. But this was a long long time ago, hence the weak passwords. Computers couldn&#x27;t crack things that fast. Today, recommendations are still based on what we expect computers will be able to crack in the foreseeable future.I remember a teacher used the password &quot;music&quot;. We had every user&#x27;s password in plaintext. This was useful when installing a new Windows domain controller and setting all the passwords (about 30 employees in the school) instead or copying hashes or letting them set their own passwords. In hindsight, I find it batshit crazy that some stupid intern (me) walked around the school with a sheet of paper with literally everyone&#x27;s password on it, logging into people&#x27;s systems where necessary or potentially forgetting the sheet somewhere. I&#x27;m not saying this never happens anywhere in the world anymore, but I do think security mindset changed in the last decades.

I&#x27;m disappointed that it followed a pattern like that, since that&#x27;s supposed to make it easier to brute-force guess.

Wow, I didn&#x27;t expect the thread to go this far

oh! I thought the whole thing was the password, apparently the first part is the hash

It&#x27;s a chess opening, in an older notation.  But for someone into chess in the 70s, it wouldn&#x27;t be hard to remember.

Seems hard to remember. Could it be a collision?

Even better if you can find it mistyped two different ways.

To be precise, in the case of a patterned password (i.e., dictionary word or something a human can recognize), it leaks all but about 2-3 bits, assuming the human can work out the most likely mistake as in your example, and we assume it&#x27;s a simple error like a nearby key or simple character flip.If it&#x27;s a random password, it may still leave 2-3 bits per character as it becomes much harder to know where the error is (e.g., if &quot;j9^vl4JO&quot; is wrong, what is the correct password?), but if you have your hands on two independent errors, which is reasonably likely, that pretty much collapses to 1-2 bits tops even in the random case (e.g., if you also have &quot;k9^vl4JP&quot; that pretty much nails it down to either the first and last being &quot;j P&quot; or &quot;k O&quot;).It is a truly terrible idea!

My dad&#x27;s fault was to bring the printout home and leave it in a public location.

That&#x27;s just a bad system design, not your dad&#x27;s fault really:&quot;You&#x27;re password &#x27;huntet2&#x27; is invalid&quot;unless the password is just random characters, anyone can guess how it was mistyped.Hell, even if it was just random characters, one could just assume that it&#x27;s one character-off from the real password, and try shifting each character around.

I&#x27;ve never done anything malicious with the knowledge, but I&#x27;ve totally learned people&#x27;s passwords just by watching their fingers type. I make an effort to have passwords that would be difficult for a human to nail down while watching them typed quickly in real time. The ubiquity of cameras has me reconsidering input and&#x2F;or authentication mechanisms, though.

&gt;if you mistyped your password, it would print the mistyped password,That&#x27;s incredibly useful. Stand next to someone, casually chatting, while they enter their password. Just before they hit [ENTER], stab a key -- say, a &#x27;z&#x27;. Boom, it prints their password with an extra &#x27;z&#x27; at the end.Sure, they&#x27;d be aware of it and likely change their password. But still. A more common use case would be to hang around and wait for them to inevitably typo the password. If you see that enough, you&#x27;ll get a really good idea about what it&#x27;s supposed to be, or at least give you enough of the password to make figuring out the missing part trivial.

I watched a variation on this in a lecture hall, when the head of school attempted to log into the system and types UsernamePassword into the username field with a big projector running.

Our high school&#x27;s library computer (in the 90s) logged failed log-ins in a file readable by anyone. Just the username, not the attempted passwords, but the return key on that computer was not reliable and a very common error was that the return key didn&#x27;t register leading to &quot;usernamepassword&quot; being in the log.

It makes me happy to read this. I cracked the admin pass at my school for a really trivial reason, I think I wanted to adjust the audio panning. By default it was set 80% left to compensate for the school&#x27;s cheap headsets.Possibly, I also wanted to disable the spyware &#x2F; remote access they had on all the computers. There no experience quite like having your control of the mouse cursor taken away by an invisible, omnipotent sysadmin. Hilariously, they wouldn&#x27;t even run a logout command remotely, but actually go to the start menu to do it, I think to make a point.

I remember guessing the admin password of the router back in high school so I could port forward a Minecraft server

i deduced my dad&#x27;s password when I was a middle-schooler.  The uni micro had a teletype and although it did not echo password characters, if you mistyped your password, it would print the mistyped password, and knowing a bit about my dad, I could figure out what the correct password was.  I logged in and sent himself an email reminding him to use a better password.

should be there in a couple of hours though

Probably a dearth of chess passwords in their database. Try haveibeenpawnd.

That&#x27;s what you get for a game where king white hat tries to capture king black hat by keeping him in check.

Interestingly enough, this password does not show up on haveibeenpwnd!

Wouldn&#x27;t that be easier to crack, since it doesn&#x27;t have any special characters?

And it would be easier to crack this way.

Algebraic notation wasn&#x27;t in common use in the US until the 80s. 3BSD was released in 1979.

Thompson is a person of class, hence opening with the queen&#x27;s pawn. The Kings Gambit accepted is too brutish.

If you can find a good link about why algebraic notation is better, it would make an excellent HN post of its own today.

But then he would have a more easily crackable password

disappointed he didn&#x27;t use algebraic notation.
Could have been: e4e5f4ef

Your switches&#x2F;keycaps must be kind of crappy if there&#x27;s that much wear on them from typing the same thing often

So you&#x27;re saying that if I get access to your current keyboard or any of your former ones, I can get all of the keys used in typing your master password just by looking at the wear pattern? Hey, thanks for the tip!

I guess you could switch keycaps at a much lower cost, depending on your keyboard model. If those are blank, randomly shuffling them around might be enough as well (if you can do without the new keyboard, and don&#x27;t think that an attacker would look at the keyswitches wear.This is also something I see quite often on mobile phones with a pin&#x2F;pattern unlock: you can often infer the pin from the wear pattern, or the grease marks on the screen if the phone was used recently.My keycap wear pattern more or less mirrors the letter frequency in the languages I write.

I use a diceware[0] passphrase for my Keepass database. I was inspired heavily by XKCD comic 936[1]. My only issue with password managers is that they are a single point of failure and are juicy targets for hackers, so I usually vet them and audit them thoroughly before I use them. I am one of those rare people that actually looks at the source code of password managers to look for flaws in the implementation (I sometimes spot flaws and duly report them to the maintainers).One caveat to diceware I never liked is how it wears out the keyboard over time as you have to type the same passphrase each time to open the vault (You would be surprised how many times I need to do this each day). I sometimes have to lock my database to avoid evil maid attacks when in a hotel for example. Of course I go through about three keyboards a year because of this, but I don&#x27;t mind the cost if it gives me a crispy fresh keyboard each time. And did I mention I don&#x27;t own merely one encrypted database, but many depending on different contexts and different devices?[0] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Diceware" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Diceware</a>[1] <a href="https:&#x2F;&#x2F;www.xkcd.com&#x2F;936&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.xkcd.com&#x2F;936&#x2F;</a>

I’m guessing the latter. Not saying my password is 8o0b7fOr2060+9

I worked with someone who had to share a password to solve a major outage. (Yes, I know...)It was a rude comment about a colleague.

Oh no not that embarrassing. I don&#x27;t record private secrets into my passwords. They&#x27;re more like &quot;I never told Cindy I loved her.&quot; with Cindy being a now-dead cat. My embarrassment threshold is low :-)

Does that mean that it is embarrassing and can be tied to you or that it is just embarrassing to say? If the first, then wouldn&#x27;t you risk being pwned and having that used against you?

You missed the &quot;slightly&quot; part of the embarrassing. You can find other more embarrassing things I wrote when you search for my email-address. Re-use of slightly embarrassing passwords is not worse than re-use of any other unique password.Also <a href="https:&#x2F;&#x2F;www.xkcd.com&#x2F;137&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.xkcd.com&#x2F;137&#x2F;</a>

I would avoid doing that, invariably they end up in dumps with your name and email next to them.One of the more interesting things about reused &quot;unique&quot; passwords is they can serve as a fingerprint to link accounts you may not otherwise be able to attribute to the same account&#x2F;individual.

Yup, Moonwalking with Einstein explains this phenomenon well. I know I&#x27;ll never forget &#x27;Sex On Hard Concrete Always Hurts The Orgasmic Areas&#x27;, which my Maths teacher passed on ~30 years ago.

It&#x27;s probably actually easier to learn vulgar passwords. Well vulgar anything really, it&#x27;s a memorization trick we were taught in school to find a way to relate boring things to sex. Probably anything that has strong emotional valence works.

In college my roommate and I made our wifi password something like a fart joke. Perfectly fine to tell to our close friends, but kinda embarrassing.One day, at the end of the semester, our female neighbor knocked on our door and asked if she could use our wifi since she was moving out the next day and had already canceled her Internet.I would have been happy to share with her, but I couldn&#x27;t bring myself to tell her the password. Instead I just said my roommate was &quot;really weird about sharing our wifi&quot; and apologized.I don&#x27;t think that incident ever actually made me change the password though.

This bothers me because I prefer to use slightly embarrassing passphrases. I do that because it creates a secondary incentive not to disclose them.

Nope, it means &quot;good move&quot;. Check is +

Exclam! Generally a good move, perhaps even unexpectedly so. Double exclam, !!, being a brilliant move, especially one with flair like a sacrifice. Triple exclam is reserved for the games of Emory Tate. ;)

It&#x27;s similar to English actually. It&#x27;s commentary, rather than semantics.! is good move.? is dubious move.If you want to carried away double&#x2F;triple those.

It&#x27;s been decades. That means &quot;Check!&quot; right?

At least in modern usage, giving the exclam to signal &quot;I prefer this opening move&quot; isn&#x27;t uncommon, so it&#x27;s not a stretch to think that it was done in the seventies too. Also it rounds the whole thing out nicely to eight characters.

the most amusing thing is the exclamation mark on such a banal opening move.

&quot;Now I need to change my password on all websites that I use &gt;:&#x2F;&quot;

&gt;Did he really use uppercase letters or even special chars? (A 7-bit exhaustive search would still take over 2 years on a modern GPU.)&gt;took 4+ days on an AMD Radeon Vega64I don&#x27;t understand. The author first claims that it would take 2 years on a modern GPU to brute force a 7 bit password with special characters but then he is helped by Nigel Williams that cracked it on 4 days on an AMD Radeon Vega64Did Nigel Williams used a better technique?
Is AMD Radeon Vega64 much faster than a &quot;modern GPU&quot;?
Did the author overstimated the difficulty?

I&#x27;m curious too, could it be due to the way the search space is explored in parallel?

This is what I thought too, the heat simply becomes overwhelming and the unit has to underclock to prevent melting.

I don&#x27;t know for sure, but these Radeon GPUs are power hungry and hot. It could be just that after multiple days the entire computer is heat soaked and goes through more thermal throttling than even the &quot;steady state&quot; GPU tests that most gamers do (a few hours).It might also be cruft building up over time with small memory leaks or imperfect memory management.

For some context of how hashcat works with GPUs:<a href="https:&#x2F;&#x2F;hashcat.net&#x2F;wiki&#x2F;doku.php?id=frequently_asked_questions#how_to_create_more_work_for_full_speed" rel="nofollow">https:&#x2F;&#x2F;hashcat.net&#x2F;wiki&#x2F;doku.php?id=frequently_asked_questi...</a>Then:<a href="https:&#x2F;&#x2F;hashcat.net&#x2F;wiki&#x2F;doku.php?id=frequently_asked_questions#why_does_hashcat_sometimes_get_very_slow_at_the_end_of_an_attack" rel="nofollow">https:&#x2F;&#x2F;hashcat.net&#x2F;wiki&#x2F;doku.php?id=frequently_asked_questi...</a>It isn’t running a single thread at 100% GPU use until the end, it has to partition up the search space and balance how it creates possible passwords on the CPU, on the GPU, and based on the kind of attack patterns you asked for - and when it’s getting to the end of the search space, some of the search space partitions are done and the remaining ones aren’t enough to load the GPU fully, so hash throughout drops.

I suspect it&#x27;s because the farther down the rule list you go, the more complicated the rules get.Password cracking often uses rule lists to modify known passwords lists in some way (adding 123 to the end, for example). These get more complicated towards the end so they take more operations.

&gt; (those familiar know the hash-rate fluctuates and
slows down towards the end)Could someone explain this to me, why does it slow down towards the end?

Queen&#x27;s pawn game:<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Queen%27s_Pawn_Game" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Queen%27s_Pawn_Game</a>[edit] See also &quot;Ken, Unix and Games&quot; by Dennis Ritchie:<a href="https:&#x2F;&#x2F;www.bell-labs.com&#x2F;usr&#x2F;dmr&#x2F;www&#x2F;ken-games.html" rel="nofollow">https:&#x2F;&#x2F;www.bell-labs.com&#x2F;usr&#x2F;dmr&#x2F;www&#x2F;ken-games.html</a>

Probably not very many. According to XKCD What If? [1] a modern keyboard takes around 2 millijoules to press a key. Typing a full novel would take a few kilojoules. Even if an old mainframe keyboard took 10x more power to press the keys you would save less than a AA battery worth of energy over writing a full novel.[1] <a href="https:&#x2F;&#x2F;what-if.xkcd.com&#x2F;102&#x2F;" rel="nofollow">https:&#x2F;&#x2F;what-if.xkcd.com&#x2F;102&#x2F;</a>

I can just say that attempting to even begin learning to play bass guitar had me exercising the fingers for two–three hours before they stopped feeling like wooden sticks on the strings. Almost every day. I.e. mashing the keyboard is no workout at all.This means, however, that a typewriter would likely noticeably exhaust a modern keyboard jockey, though not in eight characters (hopefully). But dunno about teletypes.

Uphill! Both ways!How many fewer calories do I burn when typing on a low-travel keyboard rather than an old mainframe keyboard?

He would have had to expend quite some calories to type that out every time on an ancient keyboard with chunky keys and massive travel.

Which works out to 2.2 years at the rate that the actual password was cracked (1GH&#x2F;s).

They said an exhaustive 7-bit search would take that long.Edit: That would be 128^8 =~ 72 quadrillion DES hashes.

That&#x27;s the probabilistic aspect of password cracking :-). In addition, I&#x27;m not sure if it&#x27;s 2 years with 2014 GPUs (when he did the initial cracking), or today&#x27;s GPUs.

I don’t understand why the author thought it would take years to find this password, as opposed to something closer to the four days it actually took.

Looks like it was dmac<a href="https:&#x2F;&#x2F;inbox.vuxu.org&#x2F;tuhs&#x2F;87bluxpqy0.fsf@vuxu.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;inbox.vuxu.org&#x2F;tuhs&#x2F;87bluxpqy0.fsf@vuxu.org&#x2F;</a>

I’m sort of curious what dmr’s was now (his hash is gfVwhuAMF0Trw) from the same dump...

Such a funny idea. I’d would have loved to see people’s faces when you typed it in.

You password is &quot;the21stcharacterisa&#x27;z&quot;

&gt; How more secure would something like that generally be compared to static passwords?It&#x27;s not secure at all. If someone knows the rules of the system, the entropy on that is tiny, because it&#x27;s basically a 2 letter password with only 6&#x2F;3 options.The only security would be from the obscurity of the attacker not knowing the password rules.

If I had a key logger on your system, I&#x27;d just try;<pre><code> 9A4jc@23
</code></pre>
Bam. Access granted.

But if each of those is a valid password, how does it defeat keyloggers or shoulder snoopers in any way? They just have to type in the same password.Now, if the rules were totally secret, you could make it such that each time you used a password, it was no longer valid. That would defeat the keylogger, while still allowing you to remember your 3 special characters. But of course you can&#x27;t ever assume your rules are secret (security by obscurity and all that).

&gt; You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. charactersA bank I use does something like this. On account creation you give it a long key string and on subsequent log-in it asks for three different characters (e.g. the 4th, 3rd and 9th characters) from the string.

Hey that&#x27;s actually a neat idea! You could expand upon that system by having it only check the 2nd, 5th, 10th, Nth etc. characters.So people could type in different gobbledegook each time between the characters that matter.To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters.So, if my password is: Any 8 characters, but 2nd character must be A&#x2F;B&#x2F;C&#x2F;x&#x2F;y&#x2F;z, and the 6th must be !&#x2F;@&#x2F;# then I could type:<pre><code> 9A4jc@23

 #C(@$!as

 oxo!c#-1
</code></pre>
or any other valid combinations to get in.How more secure would something like that* generally be compared to static passwords?* (Of course this is a simplified example for illustration. In practice you&#x27;d use more characters&#x2F;options.)

I have a similar anecdote. I had a password that was 14 characters long, for a school system too. One day I mistyped it and it still worked. I was puzzled and discovered that it actually took only the first 8 characters into account. From that day, whenever someone was around, I typed the first 8 characters as fast as I could (pretty fast as it was something I typed in quite often) and then I continued to type random stuff like crazy for a few seconds then hit enter and loved to see how people face when they saw it working like if what I typed actually was my exact password.

When I was living in Puerto Rico for work, the local credit union I was using had this same problem. Although the tooltip and messaging on the page said 8-16 chars, only the first 8 were used, and from my testing it had to be case insensitive.I promptly updated my direct deposit with my employer and used my more secure off-island bank as the destination for the majority of my pay, and had only the minimum required to avoid fees and act as spending money put in that acct.

This was the case for Vanguard for a long time... also, it wasn&#x27;t case sensitive. I&#x27;m not sure when it changed, but I think it was in the last couple years.

I’ve had the goddamn Citibank _require_ that I use a password 6 or 7 characters long on one of their systems. This year (2019).

It&#x27;s more fun when they limit you to X characters (no special characters!) while choosing the password but let you input any number of characters when logging in, and failing you when you typed too many.

I discovered that&#x27;s the way my banking app actually worked until only a few updates ago. The password was originally limited to 8 characters (why this was the case for an online bank password is beyond me) but the app would allow you to enter more characters into the password input. It only accepted the first 8 characters though so anything you entered after those was ignored. I discoveres this when I mistyped my password adding an extra.character at the end and hitting submit without thinking and was amazed and kind of worried to find it still worked.

I&#x27;m guilty of that. I tend to mistype my passwords a lot, since I try to keep them pretty complicated, but since I usually realize quickly enough to imperceptibly hit Ctrl-U and retype in a smooth motion, I just let onlookers believe that my password is very, very long.

You can &quot;impress&quot; people this way still, just by surreptitiously typing Ctrl-u to clear what you&#x27;ve typed so far.

I had a password for an old school system (which I wrote) that was &quot;any 21 characters where the 21st character is a &#x27;z&#x27;&quot;. People would watch me type it (mashing 20 keys then the &#x27;z&#x27;) and be amazed I could remember a password that long.

Specifically, we can conjecture they narrowed the search space to &quot;lowercase+numbers+a few symbols&quot;, excluding uppercase letters.

They got lucky&#x2F;narrowed the search space. Just because it will take me 2 years to evaluate all the possibilities, doesn&#x27;t mean I won&#x27;t immediately hit aaaaaaaa

How did they crack it in 4 days if ”a 7-bit exhaustive search would still take over 2 years on a modern GPU”? Is that overstating it?

I wonder if that process was passed by legal first. Not only does it make private (in most user&#x27;s minds) information public, it also makes it legally discoverable!

Given the frequency of online password db breaches, this seems like a really bad idea...

Agreed. I would hope that the first email was automated and nobody actually looked at the results of cracking the passwords. In the second week, you arguably had less expectation of privacy.

You shouldn&#x27;t be using deeply personal stuff like this for work passwords then.It&#x27;s very legitimate for a company to want to protect themselves from a massively damaging and costly security&#x2F;privacy incident by policing against the use of weak passwords.

I&#x27;m all for the effective strength enforcement and ejecting the creepy guy, but some people do have strong passwords that, a bad idea though it may be, embed something deeply personal to them. Just something to keep in mind before automating the sharing of cracked passwords for otherwise legitimate purposes. I consider my passwords my private information, even if they are no longer secure from a technical standpoint and shouldn&#x27;t be in use. I hope people respect that if they come across them.

The guy wasn&#x27;t fired for the password, he was fired for the sexual harassment of a coworker.And nothing you do on a work computer is secret from your employer. It&#x27;s not a &quot;private diary&quot; if you&#x27;re using your employer&#x27;s hardware.

&lt;month&gt;&lt;animal&gt;&lt;current_year&gt; every 90 days is the god pattern

He was doing a lot more than just the password.  I was being vague on purpose.  The password just exposed him.

&gt; It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.I don&#x27;t know if I&#x27;m too normal or what, but my gut feeling is that yes it&#x27;s really creepy. And all these things have different creepiness to them. Thinking a naughty thing is the least creepy. A private naughty diary is starting to be creepy. If it&#x27;s just a passage in a normal diary, it&#x27;s not too bad, if there&#x27;s a whole book just about this one girl it would get super creepy. Making your work password a naughty phrase about the girl working in front of you, definitely super creepy.Some of those I&#x27;d start to consider beginning signs of harassment honestly. The password one, it&#x27;s like slowly trying to bring to the girls attention your thoughts. What&#x27;s happening, are you hoping they see you typing it out one day? Everytime you type it do you stare at her and imagine whatever you typed? So ya, if there was all kinds of other similarly creepy small behaviors they&#x27;d add up to a pretty bad environment for that girl to be working in.Just my opinion. Maybe I&#x27;m overreacting, but I wouldn&#x27;t do that, and so I find it very surprising and creepy that someone else does. Are they harmless, innocent, didn&#x27;t know better, just have a cute crush, nice guys, maybe, but doing something unexpected to me, that I&#x27;d never think of doing, is pretty much the defining characteristic of creepy, and it naturally puts me on my guard. It&#x27;s just strange behavior, and that&#x27;s scary.Note: I&#x27;d like to hear some replies that are like... oh no, it&#x27;s not creepy, way more people have naughty passwords or big naughty diaries of their coworkers than you think. I know I do. It&#x27;s a totally normal behavior, you&#x27;re the actual outlier here if you never did any of that. Otherwise I will continue to believe this is strange and creepy behavior which warrants suspicion, and possibly a good indicator that someone makes others feel uneasy and unsafe when around them.

A private diary that is the official property of your employer, and that they have the legal access to read at any time.The system being managed here is a professional one. Keep your professional passwords professional.It&#x27;s no different than using your work email for naughty discussions.

I don&#x27;t know what to think about this. A password is supposed to be secret so I don&#x27;t know what a naughty phrase in secret is a violation of? It is not very different from writing something naughty in a private diary, or even thinking a naughty thing.

I wasn&#x27;t reading the cracked passwords for fun, I was verifying the output. And it was well known that we cracked the passwords, and he had already gotten the first warning that it was cracked, so he knew we knew it.That&#x27;s why I didn&#x27;t feel bad taking it to HR. I already had a sense that he was doing bad stuff, and the password just solidified it for me.

Yes, creepy sexists need our protection and it&#x27;s exactly the same thing as playing farmville on the bathroom.

I think this is analogous to the philosophy behind &quot;duty to report&quot; type laws. If you discover -- even through a completely unrelated activity -- harm being done to someone, it is your ethical responsibility to report it to someone who can help. Obviously some amount of discretion is necessary, as some things are sensitive enough that reporting in the wrong way, or to the wrong person, could cause the situation to be worse, but as a general rule, if you see something bad going on, you should try to make the situation better if you&#x27;re able.I think OP acted entirely appropriately.To address a couple specific points:&gt; As an admin you have an obligation to your users to not be nosyIn the free-wheeling academic sense where your users are more of a community, sure, I think that&#x27;s the accepted social contract. In the workplace, not at all. While I&#x27;m not a fan of employers spying on what their employees do on the employer&#x27;s network and hardware, I fully appreciate that it is their right to do so, and in some situations, for some purposes, I might even agree with its necessity.&gt; reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to doI don&#x27;t think &quot;fun&quot; had anything to do with it, and reporting a likely case of sexual harassment, regardless of how the information was obtained, is never &quot;slimy&quot;. Quite the opposite.&gt; Just because you have the ability to peek into the CFO&#x27;s mailbox and see what everyone&#x27;s salary is, doesn&#x27;t mean you print out the spreadsheet and take it to your boss demanding a raise.That is indeed slimy, unethical, and likely a violation of company policy, but that is not even remotely the same as what the OP did.&gt; if you got in trouble for playing Farmville or whatever while sitting on the toilet at work, which they found out about by installing cameras in the stallsAlso not even remotely the same. Any reasonable person would agree that cameras in bathroom stalls would be a gross violation of privacy (and probably illegal).

and to think of all the times i used passwords that were a some variation of “thisCompanySucks@$$!” or “B1llis@d!ck”...

Former sysadmin here. I think there&#x27;s a careful balance that needs to be struck, both by admins and users.As a user, you should realize that when you&#x27;re on company equipment, privacy is more of a courtesy than a right. It&#x27;s their equipment you&#x27;re using. It&#x27;s reasonable to expect them to use it in a way that furthers the company&#x27;s interests. So act accordingly.As an admin, you don&#x27;t ever go digging through stuff for no reason, for curiosity, voyeurism, or for personal reasons. But again, watching out for the company&#x27;s interests is part of your job, so if you run across something or have a concrete need to actively look for something (not just a fishing expedition), then lifting the veil of privacy might be the right choice or even the only right choice.Basically, in a corporate computing environment, privacy is not guaranteed, but crossing lines should have a proper justification. In your CFO example, the sysadmin is using official powers but acting in their own interest, so that&#x27;s definitely not an OK justification.

How is that slimy? You have no expectation of privacy at work. The company owns everything. They not only own it but they monitor everything that’s done on their devices.If you don’t want something read by your employer don’t do it with company property or on their WiFi. It’s a rule I live by and I never connect any personal device to my company’s guest WiFi.

I&#x27;m conflicted about this. I know I&#x27;d be pretty upset if an employer starting talking to me about a plaintext password that&#x27;s supposed to be hashed. The problem is that they brute forced it and then sent it directly off to HR? Yes, as a sysadmin it&#x27;s perfectly acceptable to be searching for weak passwords, but reading the plaintext yourself for fun then scurrying to HR is kinda a slimy thing to do. As an admin you have an obligation to your users to not be nosy, and if you find out something you shouldn&#x27;t, keep it under your hat. Just because you have the ability to peek into the CFO&#x27;s mailbox and see what everyone&#x27;s salary is, doesn&#x27;t mean you print out the spreadsheet and take it to your boss demanding a raise.It&#x27;s kinda like if you got in trouble for playing Farmville or whatever while sitting on the toilet at work, which they found out about by installing cameras in the stalls. Yes, I shouldn&#x27;t have been doing that, but how you found out is also a huge issue and I&#x27;d feel pretty violated.You should probably re-read the sudo warning:<pre><code> We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things:
 #1) Respect the privacy of others.
 #2) Think before you type.
 #3) With great power comes great responsibility.</code></pre>

Tangential but sometimes it is interesting to use a passphrase that you are ashamed of, that way you are never tempted to reveal it.

Agreed. That&#x27;s why if I were doing it today, I would just shut off the account after the second warning.Although I don&#x27;t think it&#x27;s PII if it&#x27;s all internal company data, especially if it is known that IT will crack your password.

A proper policy would’ve been to not have any human look at a user’s password and just email them a warning about their weak password. A password should be considered a PPI (personal, private information) and off limits to others, no matter how creepy (exception being a legal warrant). These days you might gotten in trouble!

I&#x27;m excited for your coming adventures, in which our intrepid hero breaks into people&#x27;s diaries and then tells their friends about the naughty things they wrote.Brave!

You essentially got someone fired for thought crime. While in this instance, that thought crime coincidentally had a real life corroboration, it was a just a lucky happenstance. You were not in the ethical right here!It could have been that you reported to HR a romantic fling between two consenting adults, while they had no intention of their private lives spilling over into the public eye.Disapprove of your actions, and further disapprove of your schadenfreude at someone&#x27;s firing

This is the best password policy there is. The only time I was lucky enough to live under it was for a couple years in college.Who cares how many uppercase letters I used or the last time I changed it? What matters is how crackable it is. v#ja&amp;zp is better than P@ssword1

&quot;Think of her comfort!&quot; is the lonely childless Bay Area man&#x27;s version of &quot;Think of the children!&quot;

&gt;*
One guy actually got fired for his password. He was already being super creepy and making the girl who sat across from him uncomfortable, but she never told anyone. Then we cracked his password, which was a very naughty phrase about the girl who sat across from him. I reported it to HR, who asked the girl, who then said he was creepy, and so they acted swiftly on the reports and got him out of there.*So, he never did anything specific to call for, but just &quot;was creepy&quot; (which can often mean he was not very pretty and&#x2F;or awkward socially &#x2F; in expressing his feelings, as opposed to someone who would assault or anything close). And he had a password (in private) that was lewd or whatever, which he did not intend to share with anybody.Yeah, let&#x27;s fire the guy...

A string of dictionary words and a very common name.

What would be a weak creepy password? I feel those properties run opposite. Weak enough to be bruteforced and creepy enough to get fired. Good job on that fella’s part I would say!

Greg did that at Blekko as well. That is why you always crack the sysadmins password first, and use that. So when they crack it they know that you known that they know.

Back when I worked in IT many years ago, one of the things I did each week was run JohnTheRipper on our password file. If it cracked your password, it sent you an email saying your password was weak and you had to change it.If you were in the next week&#x27;s batch, it emailed you and told you &quot;your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it&quot;. Yes, I emailed them their password in plain text using our internal email system. Jury&#x27;s still out on whether that was a good idea. :)The next week we just disabled your account and you had to come to IT to fix it.One guy actually got fired for his password. He was already being super creepy and making the girl who sat across from him uncomfortable, but she never told anyone. Then we cracked his password, which was a very naughty phrase about the girl who sat across from him. I reported it to HR, who asked the girl, who then said he was creepy, and so they acted swiftly on the reports and got him out of there.

&gt; the chess program (written by Ken Thompson)AHHHH thank you this makes much more sense now

the password is the last part: p&#x2F;q2-q4!it&#x27;s a notational way in the chess program (written by Ken Thompson) to describe a chess move, &quot;pawn from Queen&#x27;s 2 to Queen&#x27;s 4.&quot;A very common opening move that &quot;puts a pawn in the center, controlling the important e5-square, and opens the line for the Bc1.&quot;[1]The notation is old. Modern notation would just write it as &quot;d4&quot; because there&#x27;s only one piece (a pawn) who can move to that square as the first move and only one spot from which it can move (d2).[1] <a href="https:&#x2F;&#x2F;www.chess.com&#x2F;openings&#x2F;A40-Queens-Pawn-Opening" rel="nofollow">https:&#x2F;&#x2F;www.chess.com&#x2F;openings&#x2F;A40-Queens-Pawn-Opening</a>

<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Chess_notation" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Chess_notation</a>

<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Chess_notation" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Chess_notation</a>See the &quot;chess notation examples&quot; table. The password doesn&#x27;t match any chess notation, but it&#x27;s close enough that it&#x27;s obviously (to me) intended to be a chess move. In particular, it moves the pawn in front of the queen (in the initial position) forwards two spaces.

I still have 0 idea what&#x27;s interesting about this. How is this a chess move?

p&#x2F;q2-q4!p : pawn&#x2F; : atq2 : queen&#x27;s file, rank 2- : moves toq4 : queen&#x27;s file, rank 4! : good move!

What does the p&#x2F; part mean? My chess experiences is all after the popularity of descriptive notation...

Yes, &quot;1. d4!&quot; and &quot;1. e4!&quot; are a sort of a Grandmaster joke in chess, showing their strong preference for one the classic competing openings.

Yes. The smugness in the exclamation mark is quite funny in a way that keeps me grinning for way too long. It&#x27;s a bit like a three-year-old declaring &quot;I&#x27;ve got shoes on!&quot;

If anyone is curious, the equivalent in modern notation is “1. d4!”. Moving the pawn in front of the queen forward by two spaces. The exclamation point indicates that the annotater believes it to be a particularly strong move (describing a standard move from opening theory that way is a bit tongue-in-cheek).

I&#x27;m feeling like it is not appropriate to publicly post passwords, even when they are old.

Do you know the train biscuits story?<a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=SF2fZ2iOXhk" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=SF2fZ2iOXhk</a>Imagine the anecdote coming from the person you wall&#x27;d.

Better yet, open the &#x2F;etc&#x2F;passwd and see the root user&#x27;s password wasn&#x27;t set...Back in college I ran ToneLoc overnight and would try ftp on the successful hits. One server didn&#x27;t have root set, so I telnet&#x27;ed, &lt;Enter&gt; when prompted for the password, and I was in.I ran &#x27;who&#x27;, saw a user logged in. Decided to wall them a message of &quot;You should really set your root password.&quot; and logged out.A couple of days later, I got an email on the trash email account I would use for ftp logins - dude was super nice but freaked out and wanted to know how I found his server. I didn&#x27;t reply.

This brings back memories of a common exploit w&#x2F;tftp, such that you could download an unshodowed &#x2F;etc&#x2F;passwd file from a remote machine, decrypt it, log into that remote system, collect new hosts from &#x2F;etc&#x2F;hosts, then rinse and repeat.  Hash rate were pretty slow back then, but the fact that people used passwds straight out of dictionaries helped, so I&#x27;m told...

I&#x27;m certainly not going to let reality get in the way of a joke about the compact expressiveness of J.

The password is only the last 8 characters, everything before the colon is the password&#x27;s hash.

That password was pretty long - could be a complete windowing system written in J.

Revealing people&#x27;s internet pawn habits shouldn&#x27;t be done lightly ... &#x2F;dadjoke

This was a crappy thing to do even though the reason it is crappy wasn&#x27;t the case here?

In my opinion this was a pretty crappy thing to do. Password could contain personal and potentially embarrassing information, even if that wasn&#x27;t the case here.

One would hope, but it still seems like common courtesy to give him a heads up.

The &#x2F;etc&#x2F;passwd file from which this password was unearthed has a date of Jan 5 1980 (from a 3BSD tar file). Presumably ken has updated his password since then.

Did anyone bother to ask Ken’s permission first before publishing his password on the public internet? Based on his reaction he clearly didn’t mind, but still!

Ken Thompson's Unix Password