Slashdot Mirror
Fun With Passwords?
eSims asks: "Most all SysAdmins have the pleasure of picking passwords and while we know the rules for picking good passwords we also know how to have a little fun with them as well. Password choices may be inside jokes about management, comments on the company, or just torture for the users we assign them to, but often they are funny. Without giving away the company secrets what are some of your funny stories about password selection?"
We use a generation tool to create our passwords from "/usr/dict/words". It breaks passwords down to 3 word chunks (from 3 to 4 characters) with random characters between them. This makes passwords from 11 - 14 characters which is more then safe for user accounts.
When they want to change we have another tool that works based on some of those rules so users can just reset their password to password.
Check out Mon and Mon.cgi
I have a friend who works at NASA (not like 'Houston, we have a problem!', but a local office in MD).
He was working on deploying some APs at the office, rather configuring them after they had already been set up.
He goes to configure one of them, and finds that the default password doesn't work (that's a good thing, of course). So he yells across the room to his supervisor: 'Hey Jim, what's the password to the AP?'
Jim yells back: 'cumshot'.
For some reason I really doubt that anyone else was aware of that, or he surely would've had to change it.
- single sign on everywhere, so no-one (including the sys admin) ever has multiple passwords.
- initial passwords are generated randomly, instead of at the whim of an already over-worked sys admin.
- no-one but the user ever knows what the user's initial password is.
Ha ha ha. Isn't that funny?Hypothesis:
IT staff regularly reads user passwords (for fun, profit, bogus administration, lack of professionalism, total misunderstanding of why security requires the sanctity of private passwords).
Try this experiment:
1. Change your password(s) to something abusive toward the IT staff.
2. Observe the IT staff (watch for them to become irate, agitated, angry, or any other such synonyhm).
3. Change this password everywhere you've used it across the Internet
Step 3, of course, brings into question the diligence of the user.
As in:
your password is changed
your password is invalid
I know a guy who used to work at IBM. He told me that in all of their systems, the default password was... you guessed it "IBM". And this was also in systems with sensitive data. This was in the late nineties, where they really should know better, but I guess they didn't.
Hope they have changed the passwords by now.
One of the duties of being a Sys-admin is giving out passwords/access for vendors. You need to poke fun at them for all the outages.
g0f1x[t
Also one vendor pissed me off, so I used a competing vendor as a password. example, "3yC!sc0"
But then, its funny you spend that much time coming up with entertaining passwords and the hardware only supports telnet.
I once read a tip about website passwords where you shouldn't have the same password for all sites that need a logic. One of the best suggestions I read was to have a password of say 4 characters, and intersperse the website name into it.
e.g. if your password is 1234 and you're logging into download.com it might be 1d2o3w4l or if it's slashdot.com then 1s2l3a4s or if it's msn.com then 1c2r3a4p etc. It's different for all and harder to guess, and cos it's not a word, anyone watching the keyboard might not pick up on you typing it.
Get paid to search..It's geniune and
I use alpha-numeric passwords religiously, and usually throw a couple non alpha numerics in the mix. On more than one occasion, I've forgotten them. Nothing will humble a guy like having to break into his own box, and succeeding.
I can personally attest that Simon Travaglia on separate occasions changed my password to:
- "fuckwit"
- "ican'tremembermypassword"
Great days, great days.
We set him up, and tell him his password is blank.
Two minutes later, he comes back awfully upset, demands that we reset his password, cause it wasn't blank. So we do.
2 minutes later, he's really getting pissed. Comes back with the head of IT. We ask him if the caps lock is on? He gets furious, asking how the hell it could matter if the caps was on with a blank password. We respond with, "there is a big difference between a capital B and a little b". He is seething, but slowly the realization creeps in, and he figures out what the hell we meant. Our boss, sits there like a statue, till the sales guy leaves, and then just explodes in laughter so hard he couldn't stand.
ahh, the days of the dot-coms, how I will miss thee...
What are we going to do tonight Brain?
And i was about to mod your comment... but I wanted a "-1 Tragic" to go along with "+1 Funny"
[Fuck Beta]
o0t!
I once knew a sysadmin who liked doing the ol' Abbott & Costello with passwords:
User: What's my password again?
Admin: "login"
User: Yeah, that's what I'm trying to do, but I can't remember my password.
Admin: "login"
(etc)
User2: What's the username for the Reservation system?
Admin: "password?"
User2: No, I remember the password is "a$$h@t" but I don't remember that funny username.
Admin: "password?"
(etc)
Eloi, Eloi, lema sabachtani?
www.fogbound.net
If I need a general password for a service to share with others, I typically take a word and l33t-ize it in a simple manner so it's not a dictionary word.
For example: wh4t3v3r or w1r3l3ss
There are only 10 kinds of people in this world... those who understand binary and those who don't
At one point, my gf (a very petite woman) was using the password: #4#I!Better
A true statement, if ever there was one.
...but I once had a customer forget "unforgettable".
The lass was a walking blonde joke. Quite bright once she had everything assembled in her head, and very efficient at what she did, but if she ever got rattled it all went out the window.
Got time? Spend some of it coding or testing
I used to do the same thing, but then stumbled across a number of password crackers that take this into account. They run dictionary attacks, but they also try every possible 'l33tsp34k' variation. It takes a while to run this kind of attack, but not quite as long as a plain ole brute force. I advise using password generating tools to create truly random passwords.
John Hancock
enough said :)
I work as a consultant within a Fortune 100 manufacturer.
During our projects we have to set up a simulation lab and run our project for a few months prior to installing at the factory.
For one project, the lab servers were administered by a person who either did not understand the purpose behind the lab, or simply did not care about our priorities. And, his delays were causing us to run behind schedule.
After some political wrangling, I assumed administrative responsibility of the machines in our test environment.
The months passed, we restored the schedule, and were packing up to head to the job site to install the system, and it was time for me to turnover the systems back to the original admin.
But, he flaked on the meeting, so I'm standing there with root on the lab systems some of which are trusted by outside networks. And, he did not bother to show for the meeting that he called.
So, I set the passwords, and put them in a sealed, unlabeled envelope, and handed them to one of the other admins with whom I had become friends.
The only instructions I gave him were: "You'll know what to do with this when the time comes."
A few weeks later, I got the phone call from my friend talking about the other admin, "He came in here shouting and cussing about how that damn consultant had locked him out of his own systems, then took off without turning over the passwords. I new then that it was time to use the envelope."
Written on the piece of paper in the envelope was one word in block letters: 1nc0mp3t3nt
[
The only cool thing about Netware was the length of passwords you could use. I was in the habit of resetting forgotten user passwords to things like 'Icantbelieveiforgotmypassword' or 'boydoIfeellikeanidiot'.
09F911029D74E35BD84156C5635688C0
Jesus loves you, I think you suck
i know of a company...which uses either 'xxx', 'x' or 'xxxxxxxxx' for their passwords on all their production servers.
I write code.
Computer teacher [yelling across crowded a computer lab]: "OK, [name], your new password is 'temp.' That's T-E-M-P 'temp.'"
As you can imagine, much fun was had with this one.
The password I use on all the systems I access is ********
Glonoinha the MebiByte Slayer
No bs, our webmaster's password is 'webmaster'. Of course so is her username and email addy.
In a Testing Lab that I ran, which access to some of the servers and equipment was to be had by several people, I created a common password. The password was "TheWrongPassword". That way when they would forget it, and would come running to me for it. I would say outloud, "did you use The Wrong Password when you logged in?" Then they would sheepishly walk away, knowing that I had given them the password while at the same time I dissed them. What was even funnier, was when they would ask again for the password, because they didn't realize that I had given them the password.
The techs at my school are fairly lazy. However, they're too arrogant and power-hungry to give anyone onsite (say, the computer lab person, a CS teacher, or the principal) root privs. They also sometimes take Friday off.
;-).
It's a Windows network, and all locked down. So imagine our surprise when they fsck up the CS classes' brand-new JDK installation, pop the JDK in C:\ of the network (to save time, they said later), and give it root privs. We started file I/O that week, so we figured we'd see what the JDK's home dir was. Whether it's supposed to be the directory javac is in, or whether they misconfigured it, I don't know. But we had root privs on the network until Monday. Good times
The password for his internet account was simply his home phone number...
My important passwords I commit to memory, but ones that aren't so important I toss in a little program I found a few months ago called Whisper. Whisper stores usernames/passwords, will generate random passwords, and allows you to copy a password to clipboard quite easily. Anyway, the program lets you password protect your password file, so I did that. A few days go by and I open my password file and type in my password. "Wrong password. Failed to open document."
Yeah, that sucked.
I used to work at a well-known computer company in Austin around 1993. One day an under-occupied programmer in my building hacked the company email server and ganked a list of everybody's passwords. You can learn a lot about your co-workers from passwords they don't think you can see.
The company's name rhymed with HELL, but for whatever reason, the most commonly re-used password was JESUS.
Passwords I assign to users are always extracts from books, magazines or anything on a nearby sheet of paper.
Out of context and with only 3 or 4 words, it often sounds absurd.
{{.sig}}
Nice I just added everyones passwords from their stories into my personal dictionary. Who knows it might save me tons of time when trying to crack a system and the dictionary attack actually works!
Creative Demolition
NAKKE OST... I know thats it.. it has to be it.. am i right ?
spelling is for people who doens't know better...
We had an old ICL running a bespoke cobol billing system which took a 5 character alphanumeric password. The admin screen would show the password as is when entered, but when reviewing a user record, or listing users, it showed the password encrypted by using a simple letter substitution.
I managed to brute-force crack the encryption one afternoon, and created a spreadsheet which used a set of lookups to allow you to enter a word, and unencrypt it into a string for the user password. By doing this you could set up a password like "td4jq" for a user, and they would have no idea that when the sysadmins reviewed the lists of users, it would read "wanka"!
Then you could (with relative impunity) select any descriptive word for the user and give them a seemingly random password.
Help desk staff like nothing more than the abuse of power...
umop apisdn aw pow f,uop aseald
I don't have any fun/funny password tales to share, but I can share a story about true password protection.
The year was 1999. I was working at a computer-related company, I won't call it a "startup" or a "dotcom" but it was similar. There were three sysadmins, and the owner didn't trust any one admin with the ability to login as root by himself. So a compromise was reached.
Each of the three admins chose a password. The three passwords were combined into one monster, master, root password. In order to login as root, all three admins needed to be present, to type their portion of the password in the correct order. Once all three admins typed in, a root login was achieved and whatever duty was necessary would be performed.
So, what if one of the 3 admins got hit by a bus on the way to work? There was a contingency plan. Each of the three of us entrusted our password to one of the other two. In the event of an emergency, assuming two of the three admins were present, the full password could be reconstructed. For example,
Admin A's password was apple, and he told that to Admin B
Admin B's password was blueberry, and he told that to Admin C
Admin C's password was cherry, and he told that to Admin A
So if Admin B got runover by a train, Admin A and Admin C could still login as root (because Admin C knew Admin B's password part), change the root password, and do whatever needed to be done.
The benefit was that, unless there was some sort of conspiracy, no one admin could ever login as root by himself and do anything crazy.
--
Rate Naked People at FuckMeter! (NSFW)
...we have a winner.
to add to this: you have separate, "priviledged access" admin accounts - so you NEVER logon to a box for admin work with an account that has a roaming profile to pull down, internet access or email account. this is more important in a windows farm.
...you're using l0phtcrack or similar to test the integrity of user's passwords...
you know, im from denmark, that word is kinda gross here! a rough translation is neck cheese
*resistance is futile, or fuzzy, i dunno*
At one of the companies I worked for, the admin password on the end user systems was rather appropriate:
ur2dumb
Religion is for people afraid of going to hell.
A programmer on our in house software created a swipecard with the name Butt Fucker. When it was used in the test machine it was invalid (it was supposed to be that way). So it said, "Invalid user Butt Fucker."
How about "12345"?
Passwords
There you go. All the password related stories you could want.
Since most (if not all) dictionary attacks use an English dictionary, just choose passwords from your favourite foreign language. My wife uses Welsh (and then converts to leetspeak). I prefer Japanese. "Aikotoba" is a fun one. ;)
Paul
I was consulting at a company called "ESP", and we needed to look at some data in an Excel file. For whatever reason, the employee who created the file decided to password-protect it, and he had gone home for the day. Important fact: This employee had previously treated me very poorly.
So the company's owner (we'll call her "Dee") calls him up, and asks him for the password. He says, "I'd rather not say." Then he asks her to put another employee on the phone, and he'll tell someone else.
So while she's arguing with him, I try to guess the password. Knowing this employee, though, I don't try his dog's name, I tried "fuckdee" and "fuckesp". The latter turned out to be correct, and I told her I was in. She told the employee not to come to work the next day.
The moral of this story MIGHT be to be smarter in password selection, but I'd LIKE to think it's to not piss off the IT staff - I always could have lied about the password.
and then at one point i worked with a guy that was always hacking my windows workstation. His name was mikey so i set my password to mikeysucks and he used l0phtcrack one day to crack the sam file ......probably the most funny thing when l0pht spit out the password for him.
Passwords, are becoming trickier and trickier. We now have a new company policy that requires all servers, internal, external, etc, to have a password that is > 7 characters long, must contain alpha characters of mixed case, at least one number, and at least one punctuation mark (ie. .,!?`~, etc). It becomes quite a pain trying to remember all our servers passwords, and usernames. All I can say, is thank heavens for PassKeeper.
YOU'RE WINNER !
Another lame blog
"12345?!? That's the combination to my suitcase!"
This post cannot be rebroadcast without the express written constent of Major League Baseball.
... well known to my co-workers, for a web-based application:
Some day, all my co-workers at the main office seemed to have to work on my development machine (remote office), so I changed the master password. A phone call some time later: "Please tell me the password." Told him. Machine blocked again a few days later. Wash, rinse, repeat. Finally, I changed the password to "never". Phone call: "Please tell me the password." - "Never." (*klick* speaker on) - "Oh, come on. Tell me the password." - "Never." - "I really need the password." - "Never." And so on for ten funny minutes, with my local co-workers ROTFL.
The default master password was a stupid six-letter word, and often no one bothered to change it when installing the software at the client's site. All attempts to get some attention for the unchanged default master password failed. Now it is a long sentence about insecure default passwords, easy to remember but hard to type. Perhaps that will force them to change the f*ing default password.
Tux2000
Denken hilft.
One of the admins caught someone who forgot to log out at the end of the day and changed his password to UraDope.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
At a large company where I worked, the sales team (or maybe some department of coporate motivation, don't remember exactly) emailed out - companywide! - the advice to "use a word for your password that will motivate you. For example, make your password 'sales' so that every time you log in, you are motivating yourself to sell!"
This was followed up about 24 hours later with a letter from the IT department, which said pretty much "ignore sales, they are idiots, do not ever take their advice on passwords."
At a school I once attended, art students were issued ART-NNN accounts, where NNN is a three-digit number. These accounts came prepassworded with dictionary words, which the instructor would communicate to you. Unfortunately, an instructor threw away a printout of the spreadsheet correlating accounts with passwords, which I retrieved from the lab wastebasket.
This school also used to have passwordless novell shares with sensetive data on them.
VMS had a password generator that made nonsense words that were (supposedly) pronounceable and thus memorable. As a result of the algorithm, it would often pick a real word (or a real word plus some extra syllables). Sometimes, the real word would be offensive.
So the folks at DEC kindly put a naughty word filter into the generator (in many languages). But then there was the risk that people perusing the source code (it was available on microfiche) could be offended if they stumbled upong the naughty word table.
So the folks at DEC obfuscated the naughty word table with something trivial like ROT13.
That inevitably led to somebody circulating a program to decode the naughty word table, and a Usenet thread that taught us how to cuss in a dozen languages.
I read a funny password anecdote (maybe from Jon Bentley's Programming Pearls). A user rushed into his cube, quickly typed his credentials, and was told that his password was invalid. He sat down, entered his password again, and it was fine. Curious, he logged out, stood up, and tried again. No access. When he was standing up, logging in always failed. When he was seated, he always succeeded.
How could the computer possibly know whether he was standing or sitting?
It turns out that somebody had switched a couple of the (physical) keys on his keyboard as a joke. When the user was standing at the keyboard, he used "hunt-and-peck" typing. When he was seated, he was touch typing.
It's from the South Park movie. http://www.emptybottle.org/glass/2003/12/uncle_fu
But close ;)
Then tell him to kiss his OWN shiny metal butt!
(it's pretty good advice, too)
is "Crt+Alt+Del". Okay, not really. But that would be awful funny if it were...
Move sig now.
Back in 1997 when I was doing phone support for the ISP I'm working for, I had a customer calling us who had troubles with his mail account. It was monday afternoon and one of those days that would never end, I already had a lot of unfriendly customers on the phone that day and I was quite a bit bad mooded.
The conversation went like this:
Customer: "I'm having troubles with my mailbox"
Me: "OK, what's your username?"
Customer: <tells me his username>
Me: "OK, and what's your password?"
Customer: "Won't tell ya"
Me (getting upset): Now listen, how am I supposed to help you if you won't tell your @*#! password?! <angry>
Customer: "Sorry, you don't understand, my password _IS_ 'wonttellya'"
Me: <duh!!!>
--
sHIFT hAPPENS
hello, how are u doing well i am andrewv from nigeria how are u? i really want to know u more and i am a male a student of a university here in my country Nigeria.u can mail me andrewblessing4real@yahoo.com call..+2348056407812
hello