Crack a Password, Save Norwegian History

Christian writes "With the death of the only person who knew the password to an archive held at a museum in Norway, suddenly the data became inaccessible. The result? A nationwide radio appeal asking for "hackers" to volunteer to help solve the problem! The Norway Post has the story." I wonder if they looked under his keyboard yet..

Comments

Slashdoted Text

[Technician]

5. Juni 2002

Hackers respond to password challenge

Hackers have responded in large numbers to an appeal from the director of a culture center and literary museum on the west coast of Norway.

The password to one of their library archive systems is missing.

The museum built in honour of the famous Norwegian linguist Ivar Aasen received a gift of more than 1600 books and documents which had been catalogued and registered in a national data bank, which researchers and interested people may access.

Only trouble was that the expert who had helped the donor with the archiving work had died, and had failed to pass on the password.

In order to get access to the data base, Director Ottar Grepstad appealed on nationwide radio for help to solve the problem.
The response was above expectations, and the director is now busy chosing the expert most likely to solve the problem.

(NRK)

(this loaded very slow, but I got it.)

Re:Slashdoted Text

[ObviousGuy]

Ottar Grepstad

Heh. The director's got two Unix utilities in his name and he *still* can't hack the system.

I'm sure there's a joke in there somewhere.

Re:Slashdoted Text

[Hiro Antagonist]

*sigh*

If only his name was John Libcrypt...

As a Swede, all I can say is...

[weird mehgny]

...this only happens in Norway :)

Re:As a Swede, all I can say is...

[Anonymous Coward]

...just wait till you get computers, then we'll the laughs will be ours.

Re:As a Swede, all I can say is...

[jahalme]

Yes, and while the swedes and norwegians are attemtping to grok complicated concepts, such as passwords, we finns write our own operating systems. ;)

Re:As a Swede, all I can say is...

[Dr. Cody]

But, when it comes down to it, what could they possibly hope to learn by recovering this archive of Norwegian history? How Norwegian troops threw grenades at the Swedes, and, consequentially, how the Swedes pulled out the pins and threw them back?

so.. how are we supposed to store passwords?

[dikappa]

This is an interesting issue. Any -minimally skilled- IT operator knows he should never tell passes to other people. But, what if this person dies? How can we safely store passwords so that those can be retrieved if "shit happens"? Probably we cannot use encription (you need a pass to decrypt stuff), so what? Probably for most of us, a piece of paper in a safe place at home is enough, hackers *usually* do not break-in to get passwords. But I guess there is people around protecting *really* important data, and they do not trust anyone... what can they do to make passwords "undiscoverable" until "death" or sudden amnesy?

Re:so.. how are we supposed to store passwords?

[Rui del-Negro]

Tattoo the password inside their body. Or inside their pants; IT operators' pants are never removed near / by other people anyway.

RMN
~~~

Re:so.. how are we supposed to store passwords?

[GigsVT]

The probability of a sysadmin dying is not large

On the contrary, it's 100%. It's not a question of if, it's of when.

Re:so.. how are we supposed to store passwords?

[cowbutt]

Any -minimally skilled- IT operator knows he should never tell passes to other people. But, what if this person dies? How can we safely store passwords so that those can be retrieved if "shit happens"?

Google for "secret sharing" and you'll find plenty of references. Essentially, the secret (i.e. the password) is converted into a value that intercepts an axis of a n-dimensional graph. m points in n-dimensional space are then generated such that they lie in a straight line on a single plane. You can then distribute the values of the m points safe in the knowledge that you need at least n of them in order to calculate the point of interception of the secret.

AFAIK, this is how things like launch codes for nukes are stored and distributed (to counter the twin threats of elimination of keyholders preventing nukes from being launched, and to prevent a single rogue keyholder launching without appropriate authorisation).

Apologies to the maths/crypto purists out there if my description is fuzzy, over-simplified, or plain wrong, but it's been a while... ;-)

Better explanations can be found on RSA's site and in Ross Anderson's book "Security Engineering"

--

Re:so.. how are we supposed to store passwords?

[dangermouse]

You do change them, right?

Hell no.

That is the single most hare-brained bit of common security "wisdom" in the world.

Years ago, I picked a password that's random as hell and was very difficult to remember. No password cracker-- dictionary *or* brute force-- has broken it yet. I use this password on about ten systems.

If I changed those passwords on a regular basis, I'd have to come up with something easier to remember to make up for the decreased learning time. That would likely make my password less secure.

I keep running into admins who-- by hook or by crook-- make their users change passwords periodically. The result? Passwords on Post-It notes; passwords that are the names of pets or wives or firstborn children; sets of passwords that are absurdly simple and that get cycled through.

If they had just let the users keep their original passwords and run a cracker against the shadow file to turn up the overly simple ones, their systems would be a lot more secure. But somebody told them changing passwords frequently was a good idea, and by god their users are going to change passwords frequently.

Re:so.. how are we supposed to store passwords?

[dcigary]

Whenever I go on vacation, I keep what I call my "Hit By A Bus" document on the system. It's password encrypted and I give that to whomever I deem necessary. It contains passwords, procedures, etc of everything that I do. Then, after returning, I change as many passwords as I can...

Simple, easy.

Re:so.. how are we supposed to store passwords?

[edp]

Er, I'm not sure what you're getting at. For example, any set of points (in a space of more than two dimensions) that "lie in a straight line" are necessarily also in a plane and are in fact in infinitely many planes.

Shamir's secret sharing is easy to describe: Any polynomial of degree k-1 can be completely figured out from k points on it but not from k-1 points. So to share a secret among any number of people so that any k of them can figure out the secret and any k-1 of them cannot, you make up a polynomial whose value at x=0 is the secret and you tell each person the value of the polynomial at other points (at x=1, x=2,...).

For example, any 2 points define a line (a polynomial of degree 1). If you tell me where the line is at x=1 and x=2, I can figure out where the line is at x=0. But if you only tell me where the line is at x=1, I haven't got a clue where it is at x=0, because it could still be anywhere. If you gave a million people different values for x=1, x=2,... x=1000000, no one of them would know the value of the line at x=0, but any two of them could figure it out.

I see 5:

[Confuse Ed]

common utilities

1) tar
2) ar
3) grep
4) ps

and not so common
5) rep (well its installed on my system, but I'd never heard of it, further investigation reveals it to be a standalone lisp interpretter from the librep package (see "info librep", I am indeed learning something new every day))

More info

[Man Eating Duck]

A little info:

The database is from Dbase 4, I don't know how the security is on that format. It contains data about the norwegian linguist Ivar Aasen. For those interested in giving it a try, just search on norwegian pages to find the directors email address (name in another post). He's received quite a few emails already... (No, won't give the address here, pity the one who gets his email published on Slashdot).

Please excuse crappy english, save your grammatic flames.

Sorry, can't help...

[juliao]

I wish I could help, but I do intend to travel to the US at some later time in my life, and I don't want to be arrested for circumventig a protection device or something... Boy, do you americans have stupid laws...

What's needed is a "dead man's 'bot"

[Raetsel]

A simple program... something to send that important email, decrypt the data that you honestly don't have to safeguard anymore, etc. A program to take action when you haven't proven (password | biometric | whatever...) your continued existance on a pre-arranged schedule.

And wouldn't you know it, one exists!

I caught this discussion at Ars Technica last month. It refers to a cool-sounding program called "Dead Man's Switch (DMS)", which caught the attention of the New York Times.

Just a few issues...

• Don't go on vacation for a longer period of time than you have the 'bot set for
  (see either link, "If you're reading this, I'm dead!" type goofs have happened!)

• What happens when you actually do pass on to the great unknown, don't manage to pay your bills, and your (ISP | power company | shell host) kills your service?

• Or, more simply, what if your next of kin just tag the 'ol power switch?

Oh well... no person (or thing!) is perfect. Norway is keenly aware of this right now.

Re:this dosn't make sense.

[hyoo]

Crack a password, save history.
Get a cable modem, go to jail. [slashdot.org].

What kind of crazy backwards world are we living in?


Ladies and Gentlemen of slashdot it does not make sense. If Chewbacca lives on Endor you must acquit.

Public access?

[ciryon]

Well? What's the URL so we can all try it? They gotta trust me, I'm swedish! ;-)

Info desired to crack the password...

[gdyas]

The following info would help:

• All the names of his family & friends.
  
• All the birth/death/anniversary/etc dates he'd know, especially children or parents.
  
• Prominent words or phrases displayed in his office.
  
• A selection of words germane to his profession.
  

Combine that with the dictionary, mix well, apply cracking script and, most likely, open sesame.

As Richard Feynman used to say about safes, 99.9% of what keeps people from getting in is the perception of security, not real security. This from a guy who used to sneak in & out of Los Alamos at will during the Manhattan project.