Password cracking took off in a big way with Alec Muffett’s `crack` in 1991 https://en.wikipedia.org/wiki/Crack_(password_software) which was written to do the research on password strength that Stuart Schechter wanted. It became obvious right away that many passwords were weak.
Stuart’s suggestion to encrypt passwords using RSA (so that they could be analysed by the holder of the private key) is cunning, but it would not have had the effect that Stuart expected. Crack was around and demonstrating the problem for decades before password policies changed.
It’s also not true that password hashing was universal after the 1970s. There were lots of systems that stored them in the clear, in particular to support challenge-response authentication (eg NETBIOS). There was a period roughly covering the 1990s where networks were unencrypted (so basic password authentication was very weak) and passwords were no longer stored in world-readable files on timesharing servers. It seemed reasonable then to keep passwords in the clear — but we soon learned that password database leaks are common despite our best efforts, and that was not widely recognised until years into this century.
So for those two reasons I think Stuart’s argument is wrong about the reason that password policies remained so boneheaded for so long. There was no lack of evidence of the ways in which passwords were weak — not just from `crack`, but also plenty of reports about how users react to password reset policies by making their passwords weaker — so hashed password storage was not preventing researchers from analysing the issue.
I'm burning karma like crazy in this thread, but I've stopped caring.
> Stuart’s suggestion to encrypt passwords using RSA (so that they could be analysed by the holder of the private key) is cunning, but it would not have had the effect that Stuart expected.
Does such an analysis include the 'identity' function? i.e. the other party can read my password? Am I having a stroke? Is this different from telling kids to bring guns and knives into school, so that you can build a better metal detector?
> As a result of Morris and Thompson’s recommendations [of one-way hashing] and those who believed their assumptions without evidence, it was not until well into the 21st century that the scientific community learned just how ineffective password policies were.
Not sure about where the "scientific" community boundaries are, but I'm pretty sure that even in the pre-21st decades it was no secret among system administrators. They knew their users erred towards the most terrible passwords the system would permit.
Yes, they knew it was a problem because tools like John the Ripper, a password cracking software tool, were developed in the 1990s and showed that a lot of people used easily cracked passwords. (I mention that one because it's one I used back then, as a part-time sys admin.)
The part which makes the text correct (or at least "technically correct") is "just how ineffective". Password crackers couldn't analyze the uncracked passwords to tell you how effective they actually were, leaving doubt.
Hmm, it’s a bit of a just-so story.
The citations for password hashing need to include Roger Needham, who invented it in the late 1960s, as reported by Wilkes in 1973. https://onlinelibrary.wiley.com/doi/10.1002/spe.4380030404
Password cracking took off in a big way with Alec Muffett’s `crack` in 1991 https://en.wikipedia.org/wiki/Crack_(password_software) which was written to do the research on password strength that Stuart Schechter wanted. It became obvious right away that many passwords were weak.
Stuart’s suggestion to encrypt passwords using RSA (so that they could be analysed by the holder of the private key) is cunning, but it would not have had the effect that Stuart expected. Crack was around and demonstrating the problem for decades before password policies changed.
It’s also not true that password hashing was universal after the 1970s. There were lots of systems that stored them in the clear, in particular to support challenge-response authentication (eg NETBIOS). There was a period roughly covering the 1990s where networks were unencrypted (so basic password authentication was very weak) and passwords were no longer stored in world-readable files on timesharing servers. It seemed reasonable then to keep passwords in the clear — but we soon learned that password database leaks are common despite our best efforts, and that was not widely recognised until years into this century.
So for those two reasons I think Stuart’s argument is wrong about the reason that password policies remained so boneheaded for so long. There was no lack of evidence of the ways in which passwords were weak — not just from `crack`, but also plenty of reports about how users react to password reset policies by making their passwords weaker — so hashed password storage was not preventing researchers from analysing the issue.
I'm burning karma like crazy in this thread, but I've stopped caring.
> Stuart’s suggestion to encrypt passwords using RSA (so that they could be analysed by the holder of the private key) is cunning, but it would not have had the effect that Stuart expected.
Does such an analysis include the 'identity' function? i.e. the other party can read my password? Am I having a stroke? Is this different from telling kids to bring guns and knives into school, so that you can build a better metal detector?
> As a result of Morris and Thompson’s recommendations [of one-way hashing] and those who believed their assumptions without evidence, it was not until well into the 21st century that the scientific community learned just how ineffective password policies were.
Not sure about where the "scientific" community boundaries are, but I'm pretty sure that even in the pre-21st decades it was no secret among system administrators. They knew their users erred towards the most terrible passwords the system would permit.
Yes, they knew it was a problem because tools like John the Ripper, a password cracking software tool, were developed in the 1990s and showed that a lot of people used easily cracked passwords. (I mention that one because it's one I used back then, as a part-time sys admin.)
The part which makes the text correct (or at least "technically correct") is "just how ineffective". Password crackers couldn't analyze the uncracked passwords to tell you how effective they actually were, leaving doubt.
[flagged]
[flagged]
Two flags, zero engagement. JFC people, use your words.