Hacker News Reader

Comment by DonHopkins | Hacker News Reader

I posted this before in the "My wife has complained that OpenOffice will never print on Tuesdays" discussion [1], but it's worth repeating:

I heard a story about a terminal in a public terminal room that a user was able to consistently log in to if they were sitting down in a chair in front if the terminal, but never if they were standing up.

They thought it might be static electricity, or some mechanical problem, or "problem exists between keyboard and chair", but finally they noticed something else was amiss...

It turns out some joker had re-arranged the 1234567890 keys to be 0123456789, so when the user was standing up, they looked down at the keyboard and typed their password (which contained a digit, of course) by looking at the keys.

But when they were sitting down, they touch typed without looking at the keys, and got their password correct!

[1] https://news.ycombinator.com/item?id=11717010

View on HN

Had something like that over a decade ago doing tech support for a government reporting agency.

Report: "If my secretary logs with our account, it works. If I do, the website logs in but then later shows me errors message when I try to submit a report".[0] Entirely repeatable. Screenshots sent showing it exactly. All of us scratching our heads. How could our web server know who was sitting in front of the keyboard?

Root cause: the username was a number with a leading zero. The login didn't care if you used zeros or not, but the internal logic did care. She logged in with them, he logged in without them (or was it the other way around?). Once logged in, the username was taken from a cookie or something that had been set at login time and fed into the internal logic, which barfed.

Lessons learned: either don't have forgiving logins, or have forgiving functionality when users use inconsistent logins.

[0]They were indeed sharing an account with the same username and password. It was 2005 and government website, so this made sense.

I would take a different lesson: use internally generated ids, not user generated usernames when communicating between services in your backend.

Well technically, the username the user had was generated by us when we signed them up. I honestly think this issue probably would have presented for 1/10 users whose IDs happened to have a leading 0-digit. Our software couldn't handle a situation we had setup for it.

But yes, I do agree with the general sentiment of "communicate via something internal, not something user-supplied".

I had a similar experience with a bug in a SaaS product that integrated with bank websites. They would send us the user ID and we would use that to determine whose account to log them into on redirect (and create a new account for the user if we hadn't seen the ID before).

At some point it became clear that they ignored leading zeroes during login on their end, but still included those leading zeroes when they sent it over to us, so we had a number of duplicate accounts. I purged the duplicate accounts (delete the newest, strip the leading 0s off the oldest) at the same time that they changed their code to send over the truncated number. All went perfectly, except apparently a few spouses were upset that they could no longer use their secondary account.

Makes me think of a story i ran into somewhere about a secretary that had sorted all the files on her office PC in different folders alphabetically.

This was back during the DOS days, and i suspect it was only discovered when she complained that it would no longer start in the morning.

It may well be that said joker had the best of intentions by sorting the keys in the numerical order...

I've read this seven times now and I just can't understand it. Can you elaborate?

I assume it means that they neatly filed COMMAND.COM in folder "C", and AUTOEXEC.BAT in "A", ... No filesystem permissions or file locking to prevent you from ruining your system in DOS.

But judicious use of ATTRIB +H +S did help ameliorate such things somewhat.

Check http://www.rinkworks.com/stupid/ for a treasure trove of similar helpdesk oddities.

I used to have a work computer that would get a bsod when someone other then myself logged in. I took a knife and scraped all the letters off the keyboard. It solved my problem in the sense that no one else tried logging on to my system.

Reply on news.ycombinator.com