Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×
It's funny.  Laugh. Security

Fun With Passwords? 159

eSims asks: "Most all SysAdmins have the pleasure of picking passwords and while we know the rules for picking good passwords we also know how to have a little fun with them as well. Password choices may be inside jokes about management, comments on the company, or just torture for the users we assign them to, but often they are funny. Without giving away the company secrets what are some of your funny stories about password selection?"
This discussion has been archived. No new comments can be posted.

Fun With Passwords?

Comments Filter:
  • Generation tool (Score:3, Informative)

    by Plake ( 568139 ) <rlclark@gmail.com> on Monday August 02, 2004 @05:26PM (#9864932) Homepage
    We use a generation tool to create our passwords from "/usr/dict/words". It breaks passwords down to 3 word chunks (from 3 to 4 characters) with random characters between them. This makes passwords from 11 - 14 characters which is more then safe for user accounts.

    When they want to change we have another tool that works based on some of those rules so users can just reset their password to password.
    • Oh, I missed the funny part...

      You'd be amazed how many times the word "orgy" comes up for our list of passwords. :)

      We usually don't set new employee passwords with simlar words in it, we'll just re-generate a new one.

      • Whats funny is one piece of software didnt like a guys name, Steve Hitty. (something like that). We use first initial last name. Username = shitty

        The software would block the username. Love that pattern matching programs, "ass" was also blocked, and tons of usernames had *ass* in it. Crazy, but I understand you dont want a guy with a vulgar vanity email address.

  • NASA (Score:5, Funny)

    by boredMDer ( 640516 ) <pmohr+slashdot@boredmder.com> on Monday August 02, 2004 @05:28PM (#9864954)
    I have a friend who works at NASA (not like 'Houston, we have a problem!', but a local office in MD).

    He was working on deploying some APs at the office, rather configuring them after they had already been set up.

    He goes to configure one of them, and finds that the default password doesn't work (that's a good thing, of course). So he yells across the room to his supervisor: 'Hey Jim, what's the password to the AP?'

    Jim yells back: 'cumshot'.

    For some reason I really doubt that anyone else was aware of that, or he surely would've had to change it.
  • by Karma Farmer ( 595141 ) on Monday August 02, 2004 @05:34PM (#9865013)
    Here's a funny way to do passwords:
    • single sign on everywhere, so no-one (including the sys admin) ever has multiple passwords.
    • initial passwords are generated randomly, instead of at the whim of an already over-worked sys admin.
    • no-one but the user ever knows what the user's initial password is.
    Ha ha ha. Isn't that funny?
    • And i was about to mod your comment... but I wanted a "-1 Tragic" to go along with "+1 Funny"
    • Oooh! What's funnier is having different root passwords for every machine. Ooooh, and what really gets me cracking up is when I set it up so only a select group of users can 'su'!

      Don't even get me started on setting up ssh so you always have to enter your password! Oh man! I'm rolling! ROFLMAOLOL!!! OLOLOLOLLL!!!
    • ...we have a winner.
      to add to this: you have separate, "priviledged access" admin accounts - so you NEVER logon to a box for admin work with an account that has a roaming profile to pull down, internet access or email account. this is more important in a windows farm.
    • Re:Funny Story.... (Score:4, Interesting)

      by kris_lang ( 466170 ) on Tuesday August 03, 2004 @01:02PM (#9869714)
      Here's a -1 Truly Tragic story:

      I was at a place (up Chuck river) that was supposed to be reknowned for it's information processing savvy, Python and CORBA and other soupy-acronyms abounded everywhere. The sysadmin had the wacky idea of everyones' passwords on multiple machines being :

      First Initial + last Initial + initials of Research Program + last two numerals of year.

      Yes, I kid you not. Everyone had accounts on, oh about eight to ten unix machines, with all passwords immediately known by all fellow users. And before you get misty-eyed and say oh it was so long ago a trusting time, it was 1995. (which was a long time ago in internet time.)

  • by Nyhm ( 645982 ) * on Monday August 02, 2004 @05:44PM (#9865083)
    Hypothesis:

    IT staff regularly reads user passwords (for fun, profit, bogus administration, lack of professionalism, total misunderstanding of why security requires the sanctity of private passwords).

    Try this experiment:

    1. Change your password(s) to something abusive toward the IT staff.
    2. Observe the IT staff (watch for them to become irate, agitated, angry, or any other such synonyhm).
    3. Change this password everywhere you've used it across the Internet

    Step 3, of course, brings into question the diligence of the user.
    • This won't work, since passwords are usually stored in an encrypted form.
      • This won't work, since passwords are usually stored in an encrypted form.

        Usually? Which passwords? For what application? In-house or commercial software?

        There's not much that you can say is usually true about passwords. They've been implemented thousands of times, by thousands of different developers, and I've seen plenty of systems where user passwords are stored, plaintext, in a database somewhere, or in a file readable (supposedly) by administrators.

        There are good ways to do passwords, and bad ways



      • Uh no...

        The boss of my company is named "Bill". His password for *everything* is "Bill5" and it's not encrypted anywhere.
    • Actually, as a sysadmin myself who uses Active Directory on a Win2000 system we are unable to see the users password at all. So changing the password to something nasty towards the IT staff would have no effect.
    • The compsci department at my university had a little Linux box for students to use and a complete idiot to run it [1]. As an example, one time I ran "./configure" for some harmless program or another and he freaked out and reported me for "hacking" because it splashed files outside of my home directory (in /tmp if I remember right).

      Any way, I started touch'ing files in a world-unreadable subdirectory under $HOME like "paul bender can kiss my butt" and "paul bender dates his mother". He couldn't really s

  • by Anonymous Coward on Monday August 02, 2004 @05:54PM (#9865131)
    As in:
    your password is changed
    your password is invalid
    • One of the passwords used where I work was "correct", because when you enter a bad password, it says "Password is not correct".

      That was changed a while though. Now our new password is "eatass". Shh... don't tell anyone! ;)
    • 'secret', also nice if someone asks.

      And back at university (10 yr ago) the sysop just took the username and added a 1 in front of it.
      So account joe had password 1joe.
      Should be changed when a user logged on but many users didn't. When you went to him to ask to have your pwd reset because you forgot, the answer always was 'no prob I reset it, you know what it will be'.
      And usually he created new accounts on monday morning or so, so quite a lot of people were logged in then to see what accounts were just added
  • by BrookHarty ( 9119 ) on Monday August 02, 2004 @06:10PM (#9865208) Journal
    One of the duties of being a Sys-admin is giving out passwords/access for vendors. You need to poke fun at them for all the outages.

    g0f1x[t

    Also one vendor pissed me off, so I used a competing vendor as a password. example, "3yC!sc0"

    But then, its funny you spend that much time coming up with entertaining passwords and the hardware only supports telnet.

  • by bairy ( 755347 ) * on Monday August 02, 2004 @06:12PM (#9865224) Homepage
    I know this is drifting off topic but some people might find it useful

    I once read a tip about website passwords where you shouldn't have the same password for all sites that need a logic. One of the best suggestions I read was to have a password of say 4 characters, and intersperse the website name into it.

    e.g. if your password is 1234 and you're logging into download.com it might be 1d2o3w4l or if it's slashdot.com then 1s2l3a4s or if it's msn.com then 1c2r3a4p etc. It's different for all and harder to guess, and cos it's not a word, anyone watching the keyboard might not pick up on you typing it.

  • by Curtman ( 556920 ) on Monday August 02, 2004 @06:13PM (#9865230)
    I use alpha-numeric passwords religiously, and usually throw a couple non alpha numerics in the mix. On more than one occasion, I've forgotten them. Nothing will humble a guy like having to break into his own box, and succeeding.
    • by Anonymous Coward
      How do you hack into a computer without a password?
      • by Curtman ( 556920 )
        Well, if you've got Windows, you use a Windows CD, I don't remember the details, but Google's got instructions. If you've got Linux, you probably use Knoppix, mount the partition and clear the password out of /etc/shadow. If you got OS X, they were even nice enough to put a utility on the CD that lets you set the root password to blank.

        If you've got access to the box, you've got access to its data.
      • by brunson ( 91995 ) *
        Reboot into single user mode and use the passwd command to change your password. Or use an exploit to hack root and edit the passwd file. Or put the disk into another machine that you have root on, mount it and edit the passwd file.
      • How do you hack into a computer without a password?

        By sitting at the computer, looking around the desk and recalling some trivial piece of information about the owner, even though you've never had it. You're guarenteed to get in by your 3rd attempt or you movie admission ticket will be refunded.
  • BOFH (Score:5, Funny)

    by judd ( 3212 ) on Monday August 02, 2004 @06:34PM (#9865374) Homepage
    I can personally attest that Simon Travaglia on separate occasions changed my password to:
    - "fuckwit"
    - "ican'tremembermypassword"

    Great days, great days.
    • Oh my god! That is like Moses giving me an autographed copy of the ten commandmemts, or Andy Bechtolscheim over clocking my calculator.
    • Re:BOFH (Score:2, Funny)

      by Errtu76 ( 776778 )
      really? Last time i asked i ended up with no files in my homedir, my gf gone, house sold, parents divorced, cat died and i'm in jail.
  • by QuantumRiff ( 120817 ) on Monday August 02, 2004 @06:58PM (#9865516)
    and a bored sysadmin is a dangerous one. My all time favoritte was at an old Dot Com we worked for. New VP of sales comes running up to us needing an account quickly. (of course, nobody had told us he was hired, and in fact, just accepted the job 5 minutes before he was in our office.). So he demands a new account so he can check his portfolio on the web.

    We set him up, and tell him his password is blank.

    Two minutes later, he comes back awfully upset, demands that we reset his password, cause it wasn't blank. So we do.

    2 minutes later, he's really getting pissed. Comes back with the head of IT. We ask him if the caps lock is on? He gets furious, asking how the hell it could matter if the caps was on with a blank password. We respond with, "there is a big difference between a capital B and a little b". He is seething, but slowly the realization creeps in, and he figures out what the hell we meant. Our boss, sits there like a statue, till the sales guy leaves, and then just explodes in laughter so hard he couldn't stand.

    ahh, the days of the dot-coms, how I will miss thee...

  • by angst_ridden_hipster ( 23104 ) on Monday August 02, 2004 @07:43PM (#9865713) Homepage Journal
    I once knew a sysadmin who liked doing the ol' Abbott & Costello with passwords:

    User: What's my password again?
    Admin: "login"
    User: Yeah, that's what I'm trying to do, but I can't remember my password.
    Admin: "login"
    (etc)

    User2: What's the username for the Reservation system?
    Admin: "password?"
    User2: No, I remember the password is "a$$h@t" but I don't remember that funny username.
    Admin: "password?"
    (etc)
  • l33t speak (Score:3, Informative)

    by Alizarin Erythrosin ( 457981 ) on Monday August 02, 2004 @08:08PM (#9865827)
    If I need a general password for a service to share with others, I typically take a word and l33t-ize it in a simple manner so it's not a dictionary word.

    For example: wh4t3v3r or w1r3l3ss
    • I used to do the same thing, but then stumbled across a number of password crackers that take this into account. They run dictionary attacks, but they also try every possible 'l33tsp34k' variation. It takes a while to run this kind of attack, but not quite as long as a plain ole brute force. I advise using password generating tools to create truly random passwords.
      • I advise using password generating tools to create truly random passwords.

        The easiest is to keep a random word generator (or a dictionary) handy. Trying to come up with random words off the top of your head is an iffy proposition. You probably only use a few thousand words regularly, yet a good word file with have a few hundred thousand entries.

        For example, here's an output from a very basic generator:

        innatelyagouti0
        unpredacious!rah
        snowwhiterawly0
        betulaceae35fave0
        pandani&aerocyst>
        scho
  • GF Pass (Score:5, Funny)

    by HerbieTMac ( 17830 ) <5excelroa001@sneakemail.com> on Monday August 02, 2004 @08:34PM (#9865946)
    At one point, my gf (a very petite woman) was using the password: #4#I!Better

    A true statement, if ever there was one.
  • enough said :)
  • by thedave ( 79572 ) on Monday August 02, 2004 @10:52PM (#9866445)
    I work as a consultant within a Fortune 100 manufacturer.

    During our projects we have to set up a simulation lab and run our project for a few months prior to installing at the factory.

    For one project, the lab servers were administered by a person who either did not understand the purpose behind the lab, or simply did not care about our priorities. And, his delays were causing us to run behind schedule.

    After some political wrangling, I assumed administrative responsibility of the machines in our test environment.

    The months passed, we restored the schedule, and were packing up to head to the job site to install the system, and it was time for me to turnover the systems back to the original admin.

    But, he flaked on the meeting, so I'm standing there with root on the lab systems some of which are trusted by outside networks. And, he did not bother to show for the meeting that he called.

    So, I set the passwords, and put them in a sealed, unlabeled envelope, and handed them to one of the other admins with whom I had become friends.

    The only instructions I gave him were: "You'll know what to do with this when the time comes."

    A few weeks later, I got the phone call from my friend talking about the other admin, "He came in here shouting and cussing about how that damn consultant had locked him out of his own systems, then took off without turning over the passwords. I new then that it was time to use the envelope."

    Written on the piece of paper in the envelope was one word in block letters: 1nc0mp3t3nt

  • Forgotten Passwords (Score:3, Interesting)

    by brunson ( 91995 ) * on Monday August 02, 2004 @11:15PM (#9866571) Homepage
    The only cool thing about Netware was the length of passwords you could use. I was in the habit of resetting forgotten user passwords to things like 'Icantbelieveiforgotmypassword' or 'boydoIfeellikeanidiot'.
  • i know of a company...which uses either 'xxx', 'x' or 'xxxxxxxxx' for their passwords on all their production servers.
  • by bersl2 ( 689221 ) on Tuesday August 03, 2004 @12:04AM (#9866781) Journal
    Computer teacher [yelling across crowded a computer lab]: "OK, [name], your new password is 'temp.' That's T-E-M-P 'temp.'"

    As you can imagine, much fun was had with this one.
  • by Glonoinha ( 587375 ) on Tuesday August 03, 2004 @12:08AM (#9866797) Journal
    The password I use on all the systems I access is ********
  • by Anonymous Coward
    No bs, our webmaster's password is 'webmaster'. Of course so is her username and email addy.
  • In a Testing Lab that I ran, which access to some of the servers and equipment was to be had by several people, I created a common password. The password was "TheWrongPassword". That way when they would forget it, and would come running to me for it. I would say outloud, "did you use The Wrong Password when you logged in?" Then they would sheepishly walk away, knowing that I had given them the password while at the same time I dissed them. What was even funnier, was when they would ask again for the pa
  • The techs at my school are fairly lazy. However, they're too arrogant and power-hungry to give anyone onsite (say, the computer lab person, a CS teacher, or the principal) root privs. They also sometimes take Friday off.

    It's a Windows network, and all locked down. So imagine our surprise when they fsck up the CS classes' brand-new JDK installation, pop the JDK in C:\ of the network (to save time, they said later), and give it root privs. We started file I/O that week, so we figured we'd see what the
    • Exact opposite at my school (I'm in year 9 now).

      Usually there were about 5 nerds at my school in year 6/7 (including me) who had root privs. Then the new tech guy came, and conveniently changed the passwords without telling anyone. Including the IT coordinator. And left for the rest of the week. I always wondered why there couldn't be an admin there more than 1.5 days a week. Two years later, at high school, I found the tech working there for the rest of the week. No root privs anymore though, and I
      • It's not that people don't have root privs ... it's that people don't officially have root privs. We used to tell the techs about vulnerabilities we stumbled into, but they got pissed off and told us to stop, because they'd installed a new IDS that would take care of it for them.

        US public school, but the techs are low-bid contractors who have nothing to do with the district. Hence, no incentive to care about anything. They've done a nice job spreading FUD, though. The computer club gets shut down eve
        • I'm just a little Aussie, and over here, when you get the admin password, you suddenly have to fix every little problem with the network. Which I can do, I guess. And judging by the state of the network after Nimda went loose, I can tell that patches weren't high on the agenda of the real IT people.

          I knew that spending 2 hours a week of my school week when I was 7 learning to use a mouse would make me good at computers. I would be a perfect computer user, if just I didn't have the winmodem, and I could
  • by eingram ( 633624 ) on Tuesday August 03, 2004 @03:39AM (#9867404)
    My important passwords I commit to memory, but ones that aren't so important I toss in a little program I found a few months ago called Whisper [ivory.org]. Whisper stores usernames/passwords, will generate random passwords, and allows you to copy a password to clipboard quite easily. Anyway, the program lets you password protect your password file, so I did that. A few days go by and I open my password file and type in my password. "Wrong password. Failed to open document."

    Yeah, that sucked.
    • That reminds me of when I registered PGP keys way back in 1998 on the PGP servers. I stopped using them about four years ago, and though they are still there, for the life of me, I can't remember the passphrase! Major bummer!
  • Passwords I assign to users are always extracts from books, magazines or anything on a nearby sheet of paper.

    Out of context and with only 3 or 4 words, it often sounds absurd.

  • Wow! (Score:2, Funny)

    by NEOtaku17 ( 679902 )
    Nice I just added everyones passwords from their stories into my personal dictionary. Who knows it might save me tons of time when trying to crack a system and the dictionary attack actually works!
  • We had an old ICL running a bespoke cobol billing system which took a 5 character alphanumeric password. The admin screen would show the password as is when entered, but when reviewing a user record, or listing users, it showed the password encrypted by using a simple letter substitution.

    I managed to brute-force crack the encryption one afternoon, and created a spreadsheet which used a set of lookups to allow you to enter a word, and unencrypt it into a string for the user password. By doing this you cou
  • by FuckMeter ( 695157 ) on Tuesday August 03, 2004 @05:42AM (#9867709) Homepage
    I don't have any fun/funny password tales to share, but I can share a story about true password protection.

    The year was 1999. I was working at a computer-related company, I won't call it a "startup" or a "dotcom" but it was similar. There were three sysadmins, and the owner didn't trust any one admin with the ability to login as root by himself. So a compromise was reached.

    Each of the three admins chose a password. The three passwords were combined into one monster, master, root password. In order to login as root, all three admins needed to be present, to type their portion of the password in the correct order. Once all three admins typed in, a root login was achieved and whatever duty was necessary would be performed.

    So, what if one of the 3 admins got hit by a bus on the way to work? There was a contingency plan. Each of the three of us entrusted our password to one of the other two. In the event of an emergency, assuming two of the three admins were present, the full password could be reconstructed. For example,

    Admin A's password was apple, and he told that to Admin B

    Admin B's password was blueberry, and he told that to Admin C

    Admin C's password was cherry, and he told that to Admin A

    So if Admin B got runover by a train, Admin A and Admin C could still login as root (because Admin C knew Admin B's password part), change the root password, and do whatever needed to be done.

    The benefit was that, unless there was some sort of conspiracy, no one admin could ever login as root by himself and do anything crazy.

    --
    Rate Naked People [fuckmeter.com] at FuckMeter! (NSFW)
    • The benefit was that, unless there was some sort of conspiracy, no one admin could ever login as root by himself and do anything crazy.

      Or work in a different room from another admin.
  • by JonToycrafter ( 210501 ) on Tuesday August 03, 2004 @01:53PM (#9870081) Homepage Journal
    I was consulting at a company called "ESP", and we needed to look at some data in an Excel file. For whatever reason, the employee who created the file decided to password-protect it, and he had gone home for the day. Important fact: This employee had previously treated me very poorly.

    So the company's owner (we'll call her "Dee") calls him up, and asks him for the password. He says, "I'd rather not say." Then he asks her to put another employee on the phone, and he'll tell someone else.

    So while she's arguing with him, I try to guess the password. Knowing this employee, though, I don't try his dog's name, I tried "fuckdee" and "fuckesp". The latter turned out to be correct, and I told her I was in. She told the employee not to come to work the next day.

    The moral of this story MIGHT be to be smarter in password selection, but I'd LIKE to think it's to not piss off the IT staff - I always could have lied about the password.
  • Passwords, are becoming trickier and trickier. We now have a new company policy that requires all servers, internal, external, etc, to have a password that is > 7 characters long, must contain alpha characters of mixed case, at least one number, and at least one punctuation mark (ie. .,!?`~, etc). It becomes quite a pain trying to remember all our servers passwords, and usernames. All I can say, is thank heavens for PassKeeper.

  • "12345?!? That's the combination to my suitcase!"
    • It's not suitcase, it's luggage. And that's the kind of mistake an idiot would make (the kind of idiot who would use 12345 as a combo).
  • ... well known to my co-workers, for a web-based application:

    Some day, all my co-workers at the main office seemed to have to work on my development machine (remote office), so I changed the master password. A phone call some time later: "Please tell me the password." Told him. Machine blocked again a few days later. Wash, rinse, repeat. Finally, I changed the password to "never". Phone call: "Please tell me the password." - "Never." (*klick* speaker on) - "Oh, come on. Tell me the password." - "Never." -

  • One of the admins caught someone who forgot to log out at the end of the day and changed his password to UraDope.
  • by wmshub ( 25291 ) on Tuesday August 03, 2004 @05:22PM (#9872226) Homepage Journal
    At a large company where I worked, the sales team (or maybe some department of coporate motivation, don't remember exactly) emailed out - companywide! - the advice to "use a word for your password that will motivate you. For example, make your password 'sales' so that every time you log in, you are motivating yourself to sell!"

    This was followed up about 24 hours later with a letter from the IT department, which said pretty much "ignore sales, they are idiots, do not ever take their advice on passwords."
  • At a school I once attended, art students were issued ART-NNN accounts, where NNN is a three-digit number. These accounts came prepassworded with dictionary words, which the instructor would communicate to you. Unfortunately, an instructor threw away a printout of the spreadsheet correlating accounts with passwords, which I retrieved from the lab wastebasket.

    This school also used to have passwordless novell shares with sensetive data on them.
  • VMS (Score:3, Interesting)

    by Aidtopia ( 667351 ) on Tuesday August 03, 2004 @05:47PM (#9872476) Homepage Journal

    VMS had a password generator that made nonsense words that were (supposedly) pronounceable and thus memorable. As a result of the algorithm, it would often pick a real word (or a real word plus some extra syllables). Sometimes, the real word would be offensive.

    So the folks at DEC kindly put a naughty word filter into the generator (in many languages). But then there was the risk that people perusing the source code (it was available on microfiche) could be offended if they stumbled upong the naughty word table.

    So the folks at DEC obfuscated the naughty word table with something trivial like ROT13.

    That inevitably led to somebody circulating a program to decode the naughty word table, and a Usenet thread that taught us how to cuss in a dozen languages.

    • This is slightly offtopic, but running "strings" on 4x4 Evolution 2 (at least the Mac version) reveals all the words you can't say when using the internet play feature.

      I've never heard of anybody getting called an uncle f***er...
  • by Aidtopia ( 667351 ) on Tuesday August 03, 2004 @05:54PM (#9872532) Homepage Journal

    I read a funny password anecdote (maybe from Jon Bentley's Programming Pearls). A user rushed into his cube, quickly typed his credentials, and was told that his password was invalid. He sat down, entered his password again, and it was fine. Curious, he logged out, stood up, and tried again. No access. When he was standing up, logging in always failed. When he was seated, he always succeeded.

    How could the computer possibly know whether he was standing or sitting?

    It turns out that somebody had switched a couple of the (physical) keys on his keyboard as a joke. When the user was standing at the keyboard, he used "hunt-and-peck" typing. When he was seated, he was touch typing.

    • Model Ms... Make the KB a Dvorak layout (or even a random layout), but with a QWERTY keymap, and you've thrown off all hunt-and-peckers. Leave it as a QWERTY layout, but make it a Dvorak or random keymap (harder, because you have to relearn touch typing), and you've thrown off EVERYONE, especially if you've used a random keymap.
  • pb4ugo

    (it's pretty good advice, too)

Math is like love -- a simple idea but it can get complicated. -- R. Drabek

Working...