Hacker News Reader

Comment by drblast | Hacker News Reader

There's a security problem with that:

  $ chpasswd maybeUniqueString
  Error: maybeUniqueString already in use.

  $ su maybeUniqueString
  LOGIN OK, PROCEED TO EXPLOIT ME

So username and login are not totally redundant.

View on HN

Well, as the old saying goes, those who do not know Unix are doomed to reinvent it.... poorly. I am rarely surprised anymore by the bad ideas I see people come up with.

Sounds like you've misunderstood that either password1 or password2 will get you in!

I didn't change any behavior - just the UI strings. So you need both!

i.e:

    $ su maybeUniqueString1
    Enter Password2:

Isn't that exactly the amount of stuff they would already have to guess?

No, you can have many users, and this way you try to guess everyone's password at the same time. Also, sadly, passwords tend to be repetitive, so now someone can accidentally guess someone else's password.

Reply on news.ycombinator.com