Re: [TUHS] Recovered /etc/passwd files

[Norman Wilson <norman@oclsc.org>]

I'm amused (in a good way) that this thread persists, and
without becoming boring.

Speaking as someone who was Ken's sysadmin for six years,
I find it hard to get upset over someone cracking a password
hash that has been out in the open for decades, using an
algorithm that became pragmatically unsafe slightly fewer
decades ago.  It really shouldn't be in use anywhere any
more anyway.  Were I still Ken's sysadmin I'd have leaned
on him to change it long ago.

So far as I know, my password from that era didn't escape
the Labs, but nevertheless I abandoned it long ago--when
I left the Labs myself, in fact.

I do have one password that has been unchanged since the
mid-1990s and is stored in heritage hash on a few computers
that don't even have /etc/shadow, but those are not public
systems.  And it's probably time I changed it anyway.

None of this is to excuse the creeps who steal passwords
these days, nor to promote complacency.  At the place I now
work we had a possible /etc/shadow exposure some years back,
and we reacted by pushing everyone to change their passwords
and also by taking various measures to keep even the hashes
better-hidden.  But there is, or should be, a difference
between a password that is still in use and one that was exposed
so long ago, and in what is now so trivial an algorithm, that
it is no more than a puzzle for fans of the old-fart days.

Norman Wilson
Toronto ON