Hacker News Reader

Comment by rpmisms | Hacker News Reader

I'm disappointed that it followed a pattern like that, since that's supposed to make it easier to brute-force guess.

Yes, any sort of logic is weaker than random characters. But this was a long long time ago, hence the weak passwords. Computers couldn't crack things that fast. Today, recommendations are still based on what we expect computers will be able to crack in the foreseeable future.

I remember a teacher used the password "music". We had every user's password in plaintext. This was useful when installing a new Windows domain controller and setting all the passwords (about 30 employees in the school) instead or copying hashes or letting them set their own passwords. In hindsight, I find it batshit crazy that some stupid intern (me) walked around the school with a sheet of paper with literally everyone's password on it, logging into people's systems where necessary or potentially forgetting the sheet somewhere. I'm not saying this never happens anywhere in the world anymore, but I do think security mindset changed in the last decades.

On the other hand, being admin on a system is not that different. Sure, you don't have users' passwords, but you can still do arbitrary stuff in their name. Very large organizations will have some sort of system that logs this stuff and that you can't tamper with, but in a lot of places you could easily cover your tracks.

Edward Snowden would agree.

I would argue that having passwords made up by users and having access to a user's work account is a little different. In the former case, I see what kind of password they use and can guess that they reuse the password (or a variant) elsewhere. I can also take knowledge if I get fired, but my admin permissions are revoked.

circa 1995:

Teacher had password written on the BACK of the clipboard they carried around everywhere.

Said teacher's password was 'qwerty'.

(Yes, it worked)

It seems likely that someone will write an archaic chess notation pattern engine into the crackers now that this has been discovered and shared widely.

I agree, but didn't seem to help in this case though :-)

Reply on news.ycombinator.com