Slashdot Mirror
How Allan Scherr Hacked Around the First Computer Password
New submitter MikeatWired writes "If you're like most people, you're annoyed by passwords. So who's to blame? Who invented the computer password? They probably arrived at MIT in the mid-1960s, when researchers built a massive time-sharing computer called CTSS. Technology changes. But, then again, it doesn't, writes Bob McMillan. Twenty-five years after the fact, Allan Scherr, a Ph.D. researcher at MIT in the early '60s, came clean about the earliest documented case of password theft. In the spring of 1962, Scherr was looking for a way to bump up his usage time on CTSS. He had been allotted four hours per week, but it wasn't nearly enough time to run the detailed performance simulations he'd designed for the new computer system. So he simply printed out all of the passwords stored on the system. 'There was a way to request files to be printed offline by submitting a punched card,' he remembered in a pamphlet (PDF) written last year to commemorate the invention of the CTSS. 'Late one Friday night, I submitted a request to print the password files and very early Saturday morning went to the file cabinet where printouts were placed and took the listing.' To spread the guilt around, Scherr then handed the passwords over to other users. One of them — J.C.R. Licklieder — promptly started logging into the account of the computer lab's director Robert Fano, and leaving 'taunting messages' behind."
CTSS is notable for a lot of things. Like having the first e-mail, and the first spam.
http://opinionator.blogs.nytimes.com/2011/06/19/did-my-brother-invent-e-mail-with-tom-van-vleck-part-one/
The first documented hacking occurred earlier, to make certain networking-esque programs work.
Or something like that.
"Flyin' in just a sweet place,
Never been known to fail..."
Twenty-five years after the fact?
Try fifty...
The trouble with the world is that the stupid are cocksure and the intelligent are full of doubt.
-Bertrand Russel
On a telephone switch is a phone number a password?
In encryption is a keyphrase a password?
Regarding a bank account is your signature a password?
Is the file system address to a specific terminal a password?
I am so confuse.
Gee - modded down within 30 seconds - hit a nerve there did I?
All your mod points are belong to me!
http://xkcd.com/301/
Yeah, a nerve among people who can't stand smug idiots.
The next thing you know, cardpunches will be declared to be terrorist tools.
Hats of to you AC; and with an XKCD reference no less!
Being serious here - On what date was that cartoon posted?
Robert Fano's password was hunter2. True* fact.
"Taunting Messages"... so he was anonymous and did it for the lulz?
Bitter much?
Back in high school our band performed at EPCOT, and that night, to keep all the kids in their hotel rooms, the chaperones put tape on each door. If a student left their room, then the tape on the outside of the door would be broken loose and they would get in trouble. However there was a fatal flaw. Late that night when we were sneaking around the hotel, we simply removed the tape from a dozen other rooms.
Better known as 318230.
'There was a way to request files to be printed offline by submitting a punched card,'
Thanks to the damn full disclosure clowns...
Oracle had to finally acknowledge that same bug with their systems and should have a patch ready for this next year.
You sound like a slashdot type girl-in-training.
Fantasy: Strawberry Panic!
Reality: girlintraining
Warning! Your password is too short.
A phone number could be considered a "key" to a specific phone
I thought we didn't have any computers until NASA invented them in 1969? You know, because bouncing around on the moon in asbestos underwear was just sooo important?
When I was in middle school, there was only a handful of computers. The teachers of the day were all luddites. The program with everyones marks was on a 5.25" floppy disk in plain sight... labeled with the name of the program.
It is true. /. has taken a nose dive in intelligence. Just look at me, my karma has shot through the roof. Back in the day I couldn't get a word in edgewise.
I object to power without constructive purpose. --Spock
I'm sure not the first time it happened, but while in college in the mid '80s, the computer lab was set up with 68k-based evaluation boards to use for embedded systems programming assignments. The boards had two serial ports, one to the ASCII terminal and another to the Sun server. The boards normally operated in a transparent pass-through mode when they weren't being used, and a hot-key was used to access the board directly.
We realized that we could easily install code to look for "login:" and "password:" coming from the server and catch the replies and save them in memory. We'd check back towards the end of the day and harvest the results. We were on very good terms with the head of the CS department, so when we told him about our little exploit and proved it with his password, he was more amused than anything else.
We didn't keep or use any of the passwords, but thinking back on it, it could have been quite lucrative to sell them to a certain group of CS students who were quite prone to cheating. Those were the ones that you could put their assignment printouts together (I worked as a TA for a while) and hold them up to the light to see they were identical except for the variable names. One of them also set fire to the pile of final assignments that had been left on the floor outside a professor's office in a 100+ year old building, figuring if nobody's assignment got turned in, the professor couldn't grade them (yeah, too dumb to realize all those programs were still on the server). That was a very narrowly avoided tragedy. Ah, memories.
When I was attending a small techical college which had government contracts, one student got passwords to several research accounts and used them for homework and for the primitive games of the time. He started with guessing simple ones and shoulder surfing. After a couple of catch-and-release sequences, he seemed to self-destruct. He started running CPU and memory intensive do-nothing programs to deliberately tie up the computer. He was finally arrested, expelled, tried, convicted, and jailed.
He was sure proud he could do it. He was sure resentful that computer time wasn't free.
ITS, the successor to CTSS, didn't even have passwords. I guess they learned their lesson.
2007-08-10 according to the mouseover on the Archive page.
Is it true that if you type your password in a posting on /. it will be asterisked out?
liberare massarum ex ignorantia, clausa descendit molestie.
A while back I was curious about the origin of the customary way of logging in by first entering a user ID/name, then entering in your password. Where was this first done? Why that order? Why not ask for the password first, or ask for only the password? Maybe it used to be done differently? I knew of Multics, and thought there might be older OSes. A bit of searching turned up CTSS, and the source code. I looked at enough of the CTSS source to see that it did the login 2 step we all know.
What I'm not sure of is how it handled incorrect input. Haven't gone through the source enough to suss that out. I think if a nonexistent user ID was given, those early systems would not ask for a password, they would reject the input on the spot. Today, systems always ask for passwords before rejecting a login attempt, so that a cracker can't use the login to find valid user IDs.
User IDs were not supposed to be secret information suitable for use in authentication. You kind of needed to know them in order to send messages to other users. Now people are frequently advised to keep their usernames secret, and the username has degenerated into being part of the password.
CTSS may be the origin of the login 2 step that we still do today. That's a legacy I feel has been uncritically accepted for far too long.
Intellectual Property is a monopolistic, selfish, and defective concept. It is "tyranny over the mind of man"
That date seems about right...
I can't get off your lawn good sir, it seems your lawn's long gone, quite sure...
To spread the guilt around, Scherr then handed the passwords over to other users. One of them — J.C.R. Licklieder — promptly started logging into the account of the computer lab's director Robert Fano, and leaving 'taunting messages' behind."
And thus, the first trolling was born.
hunter2
No I can see it.
yeah, it is, If I type in "God" it gets asterisked out for me, but when I log out it shows in clear text. It's an easy way to remember your password if you forget it! Just find one of your old posts that you typed your password into!
It pays to be obvious, especially if you have a reputation for being subtle.
Um, no. J.C.R. Licklider.
I think the submitter copied the typo in the title of this blog. But really! It's not like he's some unknown guy.
J. C. R. Licklider is about the most important person in the development of the Internet. He worked in the Pentagon and had three different dedicated terminals to three different systems in his office and each had its different connection procedure. He asked the question of "Why can't these things be connected together?" (probably to save office space...)
He took his question across the hall and in 5 minutes had the funding to start what became the ARPAnet. He was as close as the computer world gets to an expeditionary explorer.
In other words: He funded the startup of the Internet.
For a really great read get a copy of "Where Wizards Stay Up Late: The Origins Of The Internet". Besides learning about the incredible minds that built the foundations, you can read a number of entertaining anecdotes. (Like AT&Ts refusal to believe that it was possible long after it was working!!!)
Ok, ok, I'll tell you the passcode to the planetary defense grid. It's "1", "2", "3", "4", "5".
http://en.wikipedia.org/wiki/Troll_(Internet)
The cartoon on 1/27/12 was numbered 1009. This means that that cartoon was 708 cartoons ago. There are three xkcd cartoons a week, which puts it 236 weeks ago. That is about four years and 28 weeks ago, which would put it roughly July of 2007.
From the paper data days. Journalist visits IBM. As he ascends, the floors get more and more luxurious. On the ground floor are the helots in accounts keeping track of the piles of money. On the first floor are the punching and verifying rooms. On the second floor are the computer operators. On the third floor are the programmers. On the fourth floor are the analysts. On the fifth floor are the system architects. On the sixth floor are the computer scientists. On the 7th floor are the research fellows. On the 8th floor are the managers. On the 9th floor is the VP suite. On the 10th floor is the office of the chief executive. On the 11th floor is a penthouse suite. There is an enormous teak desk at which sits a man gazing into space. The journalist asks his guide "Who's he?". "He's the man that found a use for chads."
From scarped cliff or quarried stone she cries "A thousand types are gone, I care for nothing, no not one."