Ken Thompson's Unix Password
leahneukirchen.org
leahneukirchen.org
I was expelled a few months later for all the fun I had after discovering this. Good times.
I also had the bright idea to try this on library computers and email kiosks around campus used by thousands of students. Rather than booting into Ophcrack I'd just log in with the admin account and run pwdump from a USB stick to collect password hashes. I figured out how to enumerate Windows machines over the network using NetBIOS and ran the pwdump utility remotely using psexec, so that I could hit every computer in the library at once, or every computer in a computer lab, etc.
I ended up cracking credentials for most students and faculty on the entire campus. I was really young at the time and thought this was some real cool James Bond shit. I never once used it for evil: never read anyone's email, never viewed anyone's private files, never poked around the academic file shares for test solutions, never tried to steal credit card numbers or social security numbers from the finance office's file share. It was purely a hack for the thrill of breaking down barriers and outsmarting the security. But MONTHS later after I had long since grown tired of tinkering with this stuff, a couple of uniformed police officers pulled me out of Calculus class and took me downtown. They tossed my dorm room and confiscated my computer and my phone and every piece of digital storage I owned. The school threw the book at me, I guess because they were so embarrassed by their incompetence on display from being beaten by a 16 year old.
(Posting on my alt account for obvious reasons.)
I don't understand this justification. The system owners can't know that to be true and have to proceed as if the systems are compromised. Would you still feel safe if a burglar broke into your house and left a note saying they didn't take anything?
Also, I didn't actually go in anyone's house. If passwords are really so inherently private even apart from their access implications, maybe we shouldn't be sharing Ken Thompson's old password.
That doesn't make it okay, but it certainly should result in a much lesser sentence than if the perpetrator had damaged or stolen property.
Just make it more secure so the next people can have a bigger challenge.
You might feel safe if he didn’t, but you wouldn’t actually be safe, would you?
If you figured this out, it wasn't all that unlikely that a less scrupulous hacker could have.
(Not judging, both because I don't like to and because you were a kid.)
You broke rules for personal enjoyment and weren't even good enough to not get caught. You didn't beat them, they beat you. It doesn't matter if you went unnoticed for several months, the fact is standard monitoring and logs were your down fall. Nobody ever thinks of the log files and network monitoring tools as being part of security. Not being prevented from accessing the system is not the same thing as successfully hacking a system unless you aren't caught either.
Yet it was running for three days before the admin got around to checking the machine, and all he did was try to log in, failed, and rebooted the machine — bringing it back to the real NetWare login screen. I got his password and pretty much everybody else's too, and to this day, more than 20 years later, I still use bits of his admin password from time to time when I'm creating temporary accounts.
I have no idea how network drives were managed with NetWare, but some students always managed to find world writable dirs (that shouldn't be). Then it was a matter of finding some obscure subdirectory, create a new one (typically containing alt+255 characters) and stick games there. Fun times.
We did get his password (and many others), but never actually did anything with it.
Mine would print the "typo" error message, save credentials, and then log me out and show you the real login screen.
I managed to get the passwords of every student and teacher, but alas, I stored them in a file called hacked_passwords.txt , in my home directory. Got busted, and got a dozen saturday detentions.
out &h64&hfe
Instareboot on a DOS machine.
It turned out that someone hadn't changed the password, he had just mistyped it over and over again. At the time, I didn't know what "1337" meant, I just thought it was a weird number, and it wasn't until many years later that I suddenly burst into laughter, realizing the "elite" level of security in that lab.
Thanks for the good times, Ron! I'm really glad he just laughed and trusted me as I explored technology instead of freaking out when my portscanners started making the printer spew out a bunch of garbage.
In year 10, a friend of mine saw our school network admin type the admin password in (he used his index fingers and typed in each character one at a time like someone with very little typing experience - this was 1998)
Anyway, I used this info to log in as the admin and I promptly deleted all of the student accounts in the school. Students around me immediately started complaining they couldn’t log in or access their assignments.
It was a stupid and immature thing to do.
Guess it’s a good reminder and lesson that you should always be careful who is watching you over your shoulder.
I got it by writing a simple login spoofer in Turbo Pascal. The funny thing is I never bothered to remove it and after I graduated, I heard from the actual administrator that they were having a strange problem where the first login of the day spit out a disk full error.
Ha, I did the exact same thing, in turbo pascal as well!
Man, I miss those simple computer systems. I used to go to other peoples' desks and type the word "end" in column 100 of the first line of their program. They'd go mad with frustration trying to figure out why their program always ran instantly, with zero errors and zero output. Or I'd like them watch me type in my 6-digit numeric password, but they still couldn't log in as me because I was slyly holding down the alt key as I typed, so the password was really a single extended ascii character...
Getting up to all those hijinks gave me a love of computers that really set the direction my life would take.
I spent three solid semesters wasting my "Computer Science" electives on breaking into the Novell system... I found tons of these encrypted passwords, and it never occurred to me to just crack one. I did find plenty of other ways to get in, though :)
Promptly used explorer to navigate to my english teachers computer via the hidden c$ share, and delete the executable from the program files folder. Next time she logged in, BOOM nothing. no start menu, no desktop, no permissions. The admins had an incredibly consistent and predictable naming scheme, and my idiot "friends" I shared the vulnerability with promptly used this to nuke like 3 labs and a bunch of teachers computers.
Fast forward 1 month, we all got pulled out of PE by a cop and sentenced to 1-3 weeks of community service.
* I abused that profile bug to work exclusively out of portable firefox on a usb drive instead of being tied to internet explorer 6 and 7, which allowed me to bypass proxy settings and get access to gmail and read slashdot/ign/halo.bungie.org during school hours! Those were the days.
We had a meagre limited amount of quota on these shared systems (between 1 and 10 MB) but teachers had 1 GB. We stored the Quake binary on one teacher's account, Starcraft 1 on another and start kicking.
Good times...
You could save the *.pwl files to a floppy, take them home, and crack them in a few minutes. All you needed was a PC that a teacher had logged into recently.
Life was so simple in the 80's.
https://www.sandiegouniontribune.com/pomerado-news/sdpn-rbhs...
https://www.sandiegouniontribune.com/sdut-poway-letter-to-st...
https://www.latimes.com/archives/la-xpm-2008-may-13-me-brief...
https://www.kpbs.org/news/2008/apr/29/officials-investigate-...
My motivation for this was wanting to install my own software on the laptop that my (underprivileged) family was forced to pay for (much more than what it was worth). This was not an optional item, it was a requirement of the state-run school. The student user account was not given local administrator rights on the computer.
After using the administrator account for six months to install my own software (this is when I first taught myself how to program), the school did a random "computer" check, where they confiscated everyone's computer - unannounced, at random, and simultaneously. My computer was asleep, signed onto the administrator account.
During the inspection, the school's IT administrators and an external contractor not only went through all of the files on the local computer, but they also my Gmail account which had credentials saved in Firefox.
When my father was called into the office to discuss what they found, the school had the state police there to discuss charges. After listening to them rant on for about thirty minutes, my father turned to the female police officer and calmly said "I would like to press charges against [ ...... ] school, and Mr [ ...... ] personally for accessing my child's email account in an unauthorized manner". The head master agreed to not proceed with charges but I was no longer welcome at the school.
Unrelated, but five years later, Mr [ ...... ] was charged with possession of child pornography and jailed for fifteen years.
> congrats.
https://inbox.vuxu.org/tuhs/CAG=a+rj8VcXjS-ftaj8P2_duLFSUpmN...
So you need the 'the manual' attached to every message to make sure people get it right. Looks downright scary sometimes though, especially the prospect of getting swiped at by UNIX greybeards if you do it wrong.
Incidentally, I'm working on a modern version of this whole page in a Reddit-like interface. (https://aether.app) It doesn't solve all of the pains of listserv, but it does help with most, including this one you mentioned.
Most modern phones use MMS Group messaging for groups larger than two. It's more efficient and flexible than SMS.
I've always wondered why people didn't use newsgroups instead of mailing lists.
> Try for free for 14 days
No.
It didn’t take long because everyone had a password that was in the dictionary.
Needless to say, people were not happy with the messenger.
So I threw the OpenMP variant of John the Ripper at it (I'd just built a 8C/16T Ryzen machine and was curious) it broke ~80% of the passwords in under an hour and all of them over an afternoon of not been in use.
Went to see the boss and gave him the list of passwords including his (which was one of the weaker ones) - he gave me the time to fix it and some other glaring security issues.
The more things change the more they stay the same.
I know enough about security to know that I really don't know about security.
It was actually decently well received by the department head; he sent out a memo to the staff to not use their wives names for emails and looked like an early computer security innovator in the physics department.
"No one will ever guess this!"
It's not because the hash is strong, but the password itself is strong (if the attackers don't know additional information about chess). The sole purpose of using a strong <del>hash or a</del> KDF on password is making low-entropy passphrase harder to crack by increasing the cost of every round, especially for cryptographic purposes. But if the passphrase is already strong (6 random words from the Diceware wordlist), you can use MD5, and I won't be surprised if it takes one year to crack. Having 10 random words is guaranteed to be uncrackable under all circumstances, because it's literally a 128-bit key.
If your password has 80-bit of entropy, it makes even listing all possible passwords (without any hashing or encryption) a difficult job. Symmetric encryption works in a similar way, it's secure not because of the computational resources it takes, but the number of possible keys it has.
What is the moral of the story? Consider to use a password manager!
Is this actually true? Note that you don't need the actual password, just a hash collision.
But if a hash, h(m), is given, finding m' where h(m) == h(m') is much more difficult, it's known as a second-preimage attack. "Image" basically means "output", "preimage" means "input", "second-preimage attack" means "find another input that has the same output already given here".
Wikipedia says a preimage attack against full MD5 still requires 2^123.4 steps (2009), only a theoretical possibility. Second-preimage should be much harder.
I don't know if there are improvements, but it's still extremely difficult. Well, of course it's not to say that you should use MD5.
MD5 wouldn't be invented for another decade or two...
Which shows that it is fairly strongly "unique", since no-one else has used it and been pwned (or he hasn't reused it and been pwned).
You can download all the hash files if you wish to run purely locally.
Also the site hosting Troy's list is Cloudflare. Cloudflare act as a https proxy for a large number of sites, so they already have access to a large number of passwords.
1. Would it be safe to build a password hash like crypt() based on 3DES today?
Maybe, kind of, it depends, don't do this. "Based on" is key here. You'd have to come up with some way to try to use 3DES in this fashion, just as the developers of Unix crypt() used DES. Basically you're trying to build a cryptographic hash out of a primitive that's not really intended for that purpose, you also need to add more salt than the Unix team did back then, and then you need it to run very slowly, preferably on everybody's hardware not just the generic (likely x86-64) general purpose CPU you're using. Lots of people already built _good_ ways to do password hashing in the 21st century, and if none of those are available somehow you should just use PBKDF2 with SHA256 and a nice big iteration count and that'll be tolerable.
2. Oh, I didn't realise, I just meant is 3DES fine for encryption?
You should not do this. The main thing wrong with DES is the key size is too small, which 3DES fixes (effective key size with full 3DES is 112 bits, which is very short today but probably not the biggest hole in whatever security system you're building). But the next biggest thing wrong with it is that it's a block cipher with a small block size, 64-bits. 64-bits is small enough that bad guys may be able to collide your blocks and set fire to everything. To avoid this: Don't use 64-bit block ciphers, go get a real cipher like AES that uses 128-bit blocks. Done. Why are you still here? Could it be secure if you can defuse the collision risk (e.g. you only encipher very small amounts of data)? Sure, but now you're defining the problem to make the choice of primitive look safe, which is always a terrible idea.
It’s probably safe from the casual attacker who just downloads a password list and runs a one word dictionary attack, but for a dedicated attacker, let alone a nation state, it’s not secure.
TL;DR: Just use AES. Even an ASIC isn’t powerful enough for that. Searching the entire key space would take more energy than the universe has. Compare that to DES that can have its entire key space searched in a few days.[0]
Edit: you said triple DES, not single. My point still stands. DES, even 3DES, is not secure. If I can crack a DES password in 4 days, I can crack a 3DES password in 12. AES with a strong password is virtually uncrackable.
It's multiplicative, not additive. 3DES is about 2^56 times as difficult to crack as DES. (Not 2^112 times because there is an attack that effectively limits it to twice the effective bits of DES, rather than the three times you might expect at first).
I promptly updated my direct deposit with my employer and used my more secure off-island bank as the destination for the majority of my pay, and had only the minimum required to avoid fees and act as spending money put in that acct.
So people could type in different gobbledegook each time between the characters that matter.
To further defeat keyloggers, shoulder snoopers etc., let each valid character be an option from a set of two or more characters.
So, if my password is: Any 8 characters, but 2nd character must be A/B/C/x/y/z, and the 6th must be !/@/# then I could type:
9A4jc@23
#C(@$!as
oxo!c#-1
How more secure would something like that* generally be compared to static passwords?
* (Of course this is a simplified example for illustration. In practice you'd use more characters/options.)
It's not secure at all. If someone knows the rules of the system, the entropy on that is tiny, because it's basically a 2 letter password with only 6/3 options.
The only security would be from the obscurity of the attacker not knowing the password rules.
That was obviously an oversimplified example to explain the rules.
In practice you could make it as obscure as you want, while keeping it easy for you to remember.
Like the sentences I just typed here. No limit on the number of characters. I could enter different long sentences each time, as long as the characters at specific positions match certain sets.
9A4jc@23
Now, if the rules were totally secret, you could make it such that each time you used a password, it was no longer valid. That would defeat the keylogger, while still allowing you to remember your 3 special characters. But of course you can't ever assume your rules are secret (security by obscurity and all that).
A bank I use does something like this. On account creation you give it a long key string and on subsequent log-in it asks for three different characters (e.g. the 4th, 3rd and 9th characters) from the string.
>ZghOT0eRm4U9s:p/q2-q4!
How is that 8 letters?
edit: LOL, I guess I'm a little dumb today
That is the password. 8 characters.
p : pawn
/ : at
q2 : queen's file, rank 2
- : moves to
q4 : queen's file, rank 4
! : good move!
I saw /etc/passwd and asked my boss how to decrypt the passwords. He told me it was a one-way encryption, so the login program would just encrypt the password you provided and compare to the encrypted value. He went on explaining the old crypt algorithm and even made a bet I could not guess his password. He said it was related to a movie.
So at 17 I was hooked and started studying the sources. In the end I just patched and recompiled the passwd binary to store clean text passwords in a hidden file. Later I learned this was called a trojan horse.
And even now, 30 years later, I remember his face when I told the movie was Citizen Kane and his password was "rosebud".
Thank you Miguel and Gorgonio for teaching me about C and Unix! This knowledge paid my rent for 3 decades and I still love the job.
[1] http://www.internationaloffice.unicamp.br/english/teaching/g...
Here's the /etc/passwd entry:
bill:.2xvLVqGHJm8M:8:10:& Joy,4156424948:/usr/bill:/bin/cshhttps://minnie.tuhs.org/pipermail/tuhs/2019-October/019124.h...
Does anyone with hashcat and GPGPU want to join me?
And yes, again it is related to chess.
One day, at the end of the semester, our female neighbor knocked on our door and asked if she could use our wifi since she was moving out the next day and had already canceled her Internet.
I would have been happy to share with her, but I couldn't bring myself to tell her the password. Instead I just said my roommate was "really weird about sharing our wifi" and apologized.
I don't think that incident ever actually made me change the password though.
I won't repeat the one we were told to remember Resistor color codes.
One of the more interesting things about reused "unique" passwords is they can serve as a fingerprint to link accounts you may not otherwise be able to attribute to the same account/individual.
It was a rude comment about a colleague.
https://www.openwall.com/presentations/Passwords12-The-Futur...
sq5UDrPlKj1nA
Seeing this news, I guessed this one on my second guess (after trying p/q2-q4!) - no brute forcing required!
p/k2-k4!
Back in college I ran ToneLoc overnight and would try ftp on the successful hits. One server didn't have root set, so I telnet'ed, <Enter> when prompted for the password, and I was in.
I ran 'who', saw a user logged in. Decided to wall them a message of "You should really set your root password." and logged out.
A couple of days later, I got an email on the trash email account I would use for ftp logins - dude was super nice but freaked out and wanted to know how I found his server. I didn't reply.
https://www.youtube.com/watch?v=SF2fZ2iOXhk
Imagine the anecdote coming from the person you wall'd.
"You're password 'huntet2' is invalid"
unless the password is just random characters, anyone can guess how it was mistyped.
Hell, even if it was just random characters, one could just assume that it's one character-off from the real password, and try shifting each character around.
If it's a random password, it may still leave 2-3 bits per character as it becomes much harder to know where the error is (e.g., if "j9^vl4JO" is wrong, what is the correct password?), but if you have your hands on two independent errors, which is reasonably likely, that pretty much collapses to 1-2 bits tops even in the random case (e.g., if you also have "k9^vl4JP" that pretty much nails it down to either the first and last being "j P" or "k O").
It is a truly terrible idea!
Shouldn't that remain utterly trivial to brute though? If we're assuming all the standard face keys+shifted, I think that's 94 characters. If it's fully unknown then search space is 94^8 or about 6E15, not good but if it's an adaptive hash sizable. But if it's only a one character error, wouldn't you just brute through each of the 8 one by one with only 94 each? That'd reduce it to just 752 possibilities at worst which is so low someone determined could even do it by hand, even ignoring any obvious psychology like the likelihood that the special character isn't the mistake and probably the only special character too.
Certainly not quibbling that it's an awful idea. I don't even like "password hints" so many systems still seem to have, they should be random!
That's incredibly useful. Stand next to someone, casually chatting, while they enter their password. Just before they hit [ENTER], stab a key -- say, a 'z'. Boom, it prints their password with an extra 'z' at the end.
Sure, they'd be aware of it and likely change their password. But still. A more common use case would be to hang around and wait for them to inevitably typo the password. If you see that enough, you'll get a really good idea about what it's supposed to be, or at least give you enough of the password to make figuring out the missing part trivial.
Possibly, I also wanted to disable the spyware / remote access they had on all the computers. There no experience quite like having your control of the mouse cursor taken away by an invisible, omnipotent sysadmin. Hilariously, they wouldn't even run a logout command remotely, but actually go to the start menu to do it, I think to make a point.
! is good move.
? is dubious move.
If you want to carried away double/triple those.
Could someone explain this to me, why does it slow down towards the end?
https://hashcat.net/wiki/doku.php?id=frequently_asked_questi...
Then:
https://hashcat.net/wiki/doku.php?id=frequently_asked_questi...
It isn’t running a single thread at 100% GPU use until the end, it has to partition up the search space and balance how it creates possible passwords on the CPU, on the GPU, and based on the kind of attack patterns you asked for - and when it’s getting to the end of the search space, some of the search space partitions are done and the remaining ones aren’t enough to load the GPU fully, so hash throughout drops.
It might also be cruft building up over time with small memory leaks or imperfect memory management.
Password cracking often uses rule lists to modify known passwords lists in some way (adding 123 to the end, for example). These get more complicated towards the end so they take more operations.
https://en.wikipedia.org/wiki/Queen%27s_Pawn_Game
[edit] See also "Ken, Unix and Games" by Dennis Ritchie:
When I create hashes for systems, I actually, now create a "version" prefix for hashes... this way I can on-run upgrade to a newer hash at login (if/when needed).
Have upgraded a older systems this way... after 30 days, dumped any that hadn't changed and sent emails notifying that they'd have to use the "forgot password" option the next time they wanted to login.
Currently using pbkdf2/hmacsha512*100000 for password hashing. 16-byte salt, 32byte result... varying too far from NIST guidelines would have been a hard sell.
output base64 values: v#.SALT.HASH
root:OVCPatZ8RFmFY:Ernie Co-vax --> cowperso
daemon:*:The devil himself --> (login not allowed)
bill:.2xvLVqGHJm8M:Bill Joy --> (password still unknown)
ozalp:m5syt3.lB5LAE:Ozalp Babaoglu --> 12ucdort
sklower:8PYh/dUBQT9Ss:Keith Sklower --> theik!!!
kridle:4BkcEieEtjWXI:Bob Kridle --> jilland1
kurt:olqH1vDqH38aw:Kurt Shoens --> sacristy
schmidt:FH83PFo4z55cU:Eric Schmidt --> wendy!!!
hpk:9ycwM8mmmcp4Q:Howard Katseff --> graduat;
tbl:cBWEbG59spEmM:Tom London --> ..pnn521
jfr:X.ZNnZrciWauE:John Reiser --> 5%ghj
mark:Pb1AmSpsVPG0Y:Mark Horton --> uio
dmr:gfVwhuAMF0Trw:Dennis Ritchie --> dmac
ken:ZghOT0eRm4U9s:Ken Thompson --> p/q2-q4!
sif:IIVxQSvq1V9R2:Stuart Feldman --> axolotl
scj:IL2bmGECQJgbk:Steve Johnson --> pdq;dq
pjw:N33.MCNcTh5Qw:Peter J. Weinberger --> uucpuucp
bwk:ymVglQZjbWYDE:Brian W. Kernighan --> /.,/.,
uucp:P0CHBwE/mB51k:UNIX-to-UNIX Copy --> whatnot
srb:c8UdIntIZCUIA:Steve Bourne --> bourne
finger::The Finger Program --> (no pw but runs a program, not a login shell)
who::The Who Program --> (no password but runs a program, not a login shell)
w::The W Program --> (no password but runs a program, not a login shell)
mckusick:AAZk9Aj5/Ue0E:Kirk McKusick --> foobar
peter:Nc3IkFJyW2u7E:Peter Kessler -- ...hello
henry:lj1vXnxTAPnDc:Robert Henry --> sn74193n
jkf:9ULn5cWTc0b9E:John Foderaro --> sherril.
fateman:E9i8fWghn1p/I:Richard Fateman --> apr1744
fabry:d9B17PTU2RTlM:Bob Fabry --> 561cml..
network:9EZLtSYjeEABE:(no name listed) --> network (runs a program, not a login shell)
tty:: --> (no password but runs a program, not a login shell)
- spouses' names (jilland1, wendy!!!, sherril.)
- birth dates (apr1744 might be April 17, 1944)
- the first word that came to your mind (whatnot, foobar, ...hello)
- though a few were thoughtful (sn74193n is a synchronous binary counter from the 7400-series chip family and likely immune to dictionary attack in that era)
- easy to type patterns on a keyboard (/.,/., or 5%ghj)
- obscure words (axolotl is a Mexican walking fish)
- different languages (12ucdort is 1,2,3,4 in Turkish)
- and some people didn't care (Steve Bourne, inventor of the Bourne shell, picked "bourne")
>took 4+ days on an AMD Radeon Vega64
I don't understand. The author first claims that it would take 2 years on a modern GPU to brute force a 7 bit password with special characters but then he is helped by Nigel Williams that cracked it on 4 days on an AMD Radeon Vega64
Did Nigel Williams used a better technique? Is AMD Radeon Vega64 much faster than a "modern GPU"? Did the author overstimated the difficulty?
Edit: That would be 128^8 =~ 72 quadrillion DES hashes.
Why would he not? I'm obviously missing something here.
Edit: Yes I have used a teletype, connected to an Elliott computer, I believe it was a 903 or at least it looked very much like this: http://www.computinghistory.org.uk/det/32480/Elliott-903
I don't understand the comments that describe (presumably random) 10+ char passwords as "crackable".
How many fewer calories do I burn when typing on a low-travel keyboard rather than an old mainframe keyboard?
I remember a teacher used the password "music". We had every user's password in plaintext. This was useful when installing a new Windows domain controller and setting all the passwords (about 30 employees in the school) instead or copying hashes or letting them set their own passwords. In hindsight, I find it batshit crazy that some stupid intern (me) walked around the school with a sheet of paper with literally everyone's password on it, logging into people's systems where necessary or potentially forgetting the sheet somewhere. I'm not saying this never happens anywhere in the world anymore, but I do think security mindset changed in the last decades.
One caveat to diceware I never liked is how it wears out the keyboard over time as you have to type the same passphrase each time to open the vault (You would be surprised how many times I need to do this each day). I sometimes have to lock my database to avoid evil maid attacks when in a hotel for example. Of course I go through about three keyboards a year because of this, but I don't mind the cost if it gives me a crispy fresh keyboard each time. And did I mention I don't own merely one encrypted database, but many depending on different contexts and different devices?
This is also something I see quite often on mobile phones with a pin/pattern unlock: you can often infer the pin from the wear pattern, or the grease marks on the screen if the phone was used recently.
My keycap wear pattern more or less mirrors the letter frequency in the languages I write.
it's a notational way in the chess program (written by Ken Thompson) to describe a chess move, "pawn from Queen's 2 to Queen's 4."
A very common opening move that "puts a pawn in the center, controlling the important e5-square, and opens the line for the Bc1."[1]
The notation is old. Modern notation would just write it as "d4" because there's only one piece (a pawn) who can move to that square as the first move and only one spot from which it can move (d2).
See the "chess notation examples" table. The password doesn't match any chess notation, but it's close enough that it's obviously (to me) intended to be a chess move. In particular, it moves the pawn in front of the queen (in the initial position) forwards two spaces.
If you were in the next week's batch, it emailed you and told you "your password is foobar, which we discovered by cracking the password file, and it is weak. You must change it". Yes, I emailed them their password in plain text using our internal email system. Jury's still out on whether that was a good idea. :)
The next week we just disabled your account and you had to come to IT to fix it.
One guy actually got fired for his password. He was already being super creepy and making the girl who sat across from him uncomfortable, but she never told anyone. Then we cracked his password, which was a very naughty phrase about the girl who sat across from him. I reported it to HR, who asked the girl, who then said he was creepy, and so they acted swiftly on the reports and got him out of there.
It's kinda like if you got in trouble for playing Farmville or whatever while sitting on the toilet at work, which they found out about by installing cameras in the stalls. Yes, I shouldn't have been doing that, but how you found out is also a huge issue and I'd feel pretty violated.
You should probably re-read the sudo warning:
We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things:
#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.Who cares how many uppercase letters I used or the last time I changed it? What matters is how crackable it is. v#ja&zp is better than P@ssword1
Brave!
It could have been that you reported to HR a romantic fling between two consenting adults, while they had no intention of their private lives spilling over into the public eye.
Disapprove of your actions, and further disapprove of your schadenfreude at someone's firing
So, he never did anything specific to call for, but just "was creepy" (which can often mean he was not very pretty and/or awkward socially / in expressing his feelings, as opposed to someone who would assault or anything close). And he had a password (in private) that was lewd or whatever, which he did not intend to share with anybody.
Yeah, let's fire the guy...
Easy brute force in 1989 I got in big trouble for it because I messed up the server.
Seems like a vacuous nitpick.
Edit: Ha ha, this is a bad joke!