Hacker News Reader

Comment by Kiro | Hacker News Reader

> Did he really use uppercase letters or even special chars?

Why would he not? I'm obviously missing something here.

Typing on a teletype is painful at the best of times. One reason why common Unix commands are so short.

Edit: Yes I have used a teletype, connected to an Elliott computer, I believe it was a 903 or at least it looked very much like this: http://www.computinghistory.org.uk/det/32480/Elliott-903

Stupid question but how do you actually type on that thing? I don't see anything resembling a keyboard.

There was a room full of teletypes connected over serial ports. They aren't shown in the photo. I can't find a picture resembling any of the teletypes that we had, but the general idea is shown here: https://en.wikipedia.org/wiki/Teleprinter#/media/File:Telesc... (The ones we actually had were a bit smaller and flatter)

The early days of mainframes had some groups of individuals who advocated for no passwords or just your username again as a password: https://www.oreilly.com/openbook/freedom/ch07.html

In the future, there won't be any need for passwords.

In the future there will be no identity theft because we all will have one identity. Resistance is futile...

you're confusing mainframes with UNIX microcomputers, and 1983 wasn't early.

Also, I rememebr when FSF hosted UNIX machines at MIT that you could telnet into without a password. It was a total mess.

Cliff Stoll's The Cuckoo's Egg grapples with this a bit. The fine line between open systems that anyone can use, and closed systems that protect your privacy and data.

It's obviously a settled question these days, but back in the 70s and 80s, this was a bit of a hot topic.

I disagree. I don't think this is at all settled, and in fact is a bit topic right now. The debate has just moved on past personal passwords.

For example, chat systems. Do you want an open one where anyone can get on with a minimum of fuss and participate? Or do you want an open one, with controls to manage spam and harassment so that people are able to be open while using it?

(I work at Mozilla, where we are moving off of IRC because, while it encourages participation from any rando who comes by, it is inaccessible to a number of people because they will be attacked if they log in. Many have moved over to Slack, which is very much closed (but open). Not to mention the channels that have been abandoned because they are overrun with spam, which makes them inaccessible or at least useless to everyone. As someone who does not get harassed, I don't really like either of those points on the spectrum even though IRC works great for me if I don't think about the people who are no longer there.)

Why not make an anti-spam/harassment ITC bot, and Take Back The Web from Slack?

It's really hard for me to understand what Mozilla's mission is these days.

You're right, my mistake!

In the early days of unix, people didn't take passwords that seriously and often shared them.

I would have borrowed "/.,/.," a long time ago had I heard about it sooner. That is just way too convenient.

My first password ever was qazwsx and I used it until I learned that it's included in "known" password text files and thus instantly crackable.

However, I wonder how safe it is to take an "easy" password like /.,/.,/., and then add a bunch of exclamation points to the end, so that it's both long and not part of a dictionary.

I'm sure password crackers are advanced enough to first try taking common passwords and then adding human modifications to make them more secure.

But something like MyDogRules###########! seems like it could be very secure, actually.

Is your username an ode to this somehow? :)

Mr. Asdf sir

Nope, but by an old internet meme: https://knowyourmeme.com/memes/asdfmovie

I forgot all about asdfmovie! That's an oldie for sure.

best practices have changed from using a complex password with lots of upper/lower and symbols to use something longer but easier to remember. More strength from misspellings and a few symbols

My Fav0riT Pas%werd

is actually pretty solid compared to

df22@$Fasdf

because the latter is more crackable

I really like the logic behind this one: https://www.xkcd.com/936/

It also doesn't require any special characters and its quite easy to remember.

The only knock on this strategy is that the more people adopt it the less effective it becomes (crackers will just start trying combinations of common words). The up-side is there are more 4-word combinations in English using only the 10,000 most common words than in any 8-character password, so even if crackers targeted the strategy specifically it's more costly to crack.

Misspelling and using a few character replacements makes a dictionary attack much more difficult. You don't have to make it too hard on yourself, just a few changes to make a really secure password.

I remember reading a blog post about how something like "aaaaaaaaaaaaaaaaaaaa…" with sufficient 'a's was actually perfectly secure since it wasn't included in any of the common cracklists or hash leaks. I think the number of 'a's was somewhere in the 30s. Obviously bruteforcing it would take absurdly long, too.*

The problem is, after I've committed a long passphrase into muscle memory, it probably takes me less time to type a 40-character phrase than count 40 individual keypresses of a button hoping I don't miscount.

* Assuming nobody is stupid enough to make a depth-first password cracking program. "I'm down to a billion 'a's now. I should be ready to try a 'b' any minute now!"

This article from 2013 shows some impressive password-generating techniques that cracked secure-looking passwords like momof3g8kids. It doesn't specifically give an example like MyDogRules###########!, but it seems reasonable they could get it by similar methods of concatenating multiple password fragments.

[0]https://arstechnica.com/information-technology/2013/05/how-c... (OK, the passwords were hashed only with MD5)

So I guess what they're saying is if they just use older password technology and they get hacked, you're screwed.

My brother used to use asdfghjkl;' as a password so he could just drag his finger across the keyboard from the a key to the enter key. The original swipe to unlock!

You often had to share your password in the real world. I've worked on systems where you were only allowed to login at one terminal at a time. If you are back and forth from your desk to the lab it is nice to know another password when you forget to logout in one location.

I guess, to enter the Unix password you need physical access to a machine. If they have access to a machine and can crack a lowercase password, a harder password will not necessarily save you. So at least you can make it easier for you to type.

In fact, the system where the password originates from (3BSD) was released in 1979 and had commands like net(1) for "execute a command on a remote machine" - given a password was provided. Since quite the early days Unix has been designated as a multi-user time-sharing OS for large expensive computers.

Reply on news.ycombinator.com