On Tue, 8 Oct 2019, Arthur Krewat wrote: *Cough cough* I remember that *cough cough*... Unix systems in those days were broken in subtle ways; we once broke into a Gould (marketed as the most secure box on the planet[*]) by social-engineering a marketoid (we tricked him into running a custom "ls" or something). "Thank you Sir, and we've just broken into your Gould; there's the root prompt". [*] They never did pay us our bounty, because we "cheated" :-) -- Dave

ken is done: ZghOT0eRm4U9s:p/q2-q4! took 4+ days on an AMD Radeon Vega64 running hashcat at about 930MH/s during that time (those familiar know the hash-rate fluctuates and slows down towards the end).

On Tue, Oct 8, 2019, 11:52 PM Nigel Williams <nw(a)retrocomputingtasmania.comwrote: Most common opening. Warner

congrats. On Wed, Oct 9, 2019 at 1:16 AM Andy Kosela <akosela(a)andykosela.com> wrote:

On Wed, 9 Oct 2019, Nigel Williams wrote: Looks like Queen's Gambit (remember the Chess machine?). I never did figure out how to counter it, being a King's Gambit bod (although I'm coming to grips with the Spanish Defence). -- Dave

I coulda told you that. One tends to learn passwords (inadvertently) when they're short and typed nearby often enough. (Sorry, ken.) If I remember right, the first half of this password was on a t-shirt commemorating Belle's first half-move, although its notation may have been different. Interesting though it is, though, I find this hacking distasteful. It was distasteful back when, and it still is. The attitudes around hackery have changed; the position nowadays seems to be that the bad guys are doing it so the good guys should be rewarded for doing it first. That's disingenuous at best, and dangerous at worst. -rob On Tue, Oct 8, 2019 at 7:50 PM Nigel Williams <nw(a)retrocomputingtasmania.com> wrote:

On Wed, 09 Oct 2019 13:09:42 -0700 Kurt H Maier <khm(a)sciops.net> wrote: I feel more than slightly absurd asking this but is the password ken used in 1980 is of "historical interest"?

On 10/9/2019 5:09 PM, Warner Losh wrote: LMFAO.

Adam Thornton wrote in <CAP2nic2g47RBxDhyvrDBSLSnd6j_bNeSfzkWhOShEFFpWMR\ hKA(a)mail.gmail.com&gt;gt;: |It is, if nothing else, a nice example of Moore's Law. | |Here's a thing on the distribution tape (at least, I assume it was; \ |happy to be wrong here) but which was assumed to be fundamentally safe, \ |because it was computationally infeasible to rainbow-table the |hash...so why not leave your real password hash on the images you gave \ |to the world? | |40 years later, it's obviously within the reach of hobbyists spending, \ |I presume, essentially zero dollars to do the computational work (at \ |least, I hope no one sunk more than a few bucks on doing it). Solar cells are costly. No, please do not say zero xy when you are using electronics. They are anything else but zero cost, not when their resources are captured, not when they or their assembly lines are built, not when they are shipped, not when they are used. Sorry if i bug you, but this day noble prices where given to people who improved batteries. Batteries are ok, but we just started the next race for rare earth and resources, instead of looking to a really sustainable future. |...which is why we went to salted passwords, and shadow pw files that \ |hid the hashes while leaving the other fields available to all users, \ |and more secure and longer hashes than original crypt(1), quite |some time ago. | |In fact there's an interesting little essay about the history of that \ |arms race up until about 33 years ago in the 1986 Unix System Manager's \ |Manual, Section 18.  It's by two guys named Morris and |Thompson. After i have given up on being smart and started to use very long passwords, entire sentences when i have to type them, dd if=/dev/urandom bs=1 count=512 | LC_ALL=C tr -cd 'a-zA-Z0-9_.,=@%^+-' otherwise, i am now in the position to nag web and other interfaces here and there which restrict password lengths to 8 or so, and/or which restrict the allowed content. Now in public. --steffen | |Der Kragenbaer, The moon bear, |der holt sich munter he cheerfully and one by one |einen nach dem anderen runter wa.ks himself off |(By Robert Gernhardt)

On 10/9/2019 3:59 PM, Rob Pike wrote: Which is why, after a point, I asked if the results were OK to post. TBH, I ranged far and wide in my hacking back in the early 80's. I am proud of it on the one hand, because it exposed me to systems that I would never have had access to. And when I found huge gaping security holes, I usually let them know. But on the other hand, well, you've expressed the exact sentiment. My only experience with TOPS-20 and UNIX early on was because of that. I never went to college. In fact, I never graduated high school. But I was hired as a consultant to do systems programming for TOPS-10 systems by the consulting firm that ran BOCES/LIRICS in Dix Hills, NY. I was mentored by a great guy, Bruce Maier, and using my hacking experience, I continue to this day to try to help both my consulting customers, and the general public whenever I can. I'm a white-hat kinda guy ;) art k.

On 10/10/2019, Clem Cole &lt;clemc(a)ccc.com&gt; wrote: [...] Some (large) companies regularly run password crackers on their employees' passwords and inform them if their passwords are found "insufficiently strong to protect company assets". Good, bad, distasteful, prudent, off-topic? N.

On Thu, 10 Oct 2019, Nemo wrote: An ex-employer of mine (not the reason I left) used to do just that. Depends :-) -- Dave

(my apologies, I sent this the other day assuming it would be sent to the list, but instead it got sent directly to rob pike! oops!) I agree, but I do believe that the time itself is a mitigating factor. To me this is much more akin to replicating a key for a lock that is no longer used, than anything else. It really doesn't serve much more purpose than pure curiosity and is of historical interest at best. On a (slightly?) related note, it's very, very surprising to me that this has hit news outlets. I never considered that this would get much more than a handful of replies, let alone this much interest. -- - Finn "Enough too is much not!" On 2019-10-09 19:59, Rob Pike wrote:

On Wed, Oct 9, 2019, 1:50 AM Nigel Williams &lt;nw(a)retrocomputingtasmania.com&gt; wrote: This feat made it The Register: https://www.theregister.co.uk/2019/10/09/ken_thompsons_old_unix_password_cr… - Dan C.

Arthur Krewat &lt;krewat(a)kilonet.net&gt; writes: I was notified Bill Joy's password does not yet appear in any list: bill:.2xvLVqGHJm8M:8:10:& Joy,4156424948:/usr/bill:/bin/csh -- Leah Neukirchen &lt;leah(a)vuxu.org&gt; https://leahneukirchen.org/

On Fri, Oct 18, 2019 at 6:35 AM Arthur Krewat &lt;krewat(a)kilonet.net&gt; wrote: I'd long suspected that someone would have done this; it would be a great way to expand the total keyspace, and extend the life of But given Ken's seminal work in password stretching and keyspace analysis, I always suspected that it was ken, not bill. in 2015, I was intrigued by the idea that he'd left a little puzzle in a hash that he knew would be publicly available. I even went so far as to construct a small FPGA cluster in pursuit of that theory: https://www.techsolvency.com/passwords/ztex/ What original caught my attention was the logic behind enforcing password quality in passwd.c during a specific era of BSD code, which exited ambiguously in a double negative of sorts, where control characters were not disallowed during password entry. (I'll try to dig up the source.) Anyway, I must have made an error in my original work in 2015, in which I found both of ken's: https://twitter.com/TychoTithonus/status/1182181560264491008 ... but managed to miss bill's entirely, thinking that it had already been cracked. In the superset of all CSRG-published distros, there are slightly more than 1400 total hashes, and one of bill's appears to have been lost in the shuffle (the other was trivial). So some hearty (and bittersweet!) kudos for solving this puzzle! It is what drove me into password auditing as a passion (and profession). Royce -- Royce Williams Tech Solvency

On Fri, Oct 18, 2019 at 7:01 AM Royce Williams &lt;royce(a)techsolvency.com&gt; wrote: Specifically, see the eras in which passwd.c looked something like this: https://github.com/dank101/4.2BSD/blob/708b3890ac0c2f034f2840b5ee9125b3c83a… while (c = *p++) { if (c >= 'a' && c <= 'z') flags |= 2; else if (c >= 'A' && c <= 'Z') flags |= 4; else if (c >= '0' && c <= '9') flags |= 1; else flags |= 8; } if (flags >= 7 && pwlen >= 4) ok = 1; I was intrigued that the "special characters" character set was defined negatively, such that control characters would also count. Royce

I have no opinion on the password hacking (especially since Ken seemed fine with it), but this is to me distasteful. The media was alerted, and that media was of all things The Register? It's not exactly a site known for its thoughtful or balanced journalism. -Henry On Thu, 10 Oct 2019 at 04:22, Dan Cross &lt;crossd(a)gmail.com&gt; wrote:

On 10 Oct 2019 10:05 -0400, from krewat(a)kilonet.net (Arthur Krewat): The circle is now all; it's back in the blogosphere. Though Schneier refers to these as passwords of "early Internet pioneers". https://www.schneier.com/blog/archives/2019/10/cracking_the_pa.html -- Michael Kjörling • https://michael.kjorling.se • michael(a)kjorling.se “The most dangerous thought that you can have as a creative person is to think you know what you’re doing.” (Bret Victor)

On Thu, 10 Oct 2019, Henry Bent wrote: I've found The Register to be pretty OK, but what would you recommend in its place? -- Dave

On 9 Oct 2019 07:52 +1100, from dave(a)horsfall.org (Dave Horsfall): You might be. At least, what you describe definitely bears a close resemblance to events recounted in Stoll's book. Of course, that by itself doesn't mean something similar can't have been done by or happened to others. When all you've got is a hammer... -- Michael Kjörling • https://michael.kjorling.se • michael(a)kjorling.se “The most dangerous thought that you can have as a creative person is to think you know what you’re doing.” (Bret Victor)