undefined | Better HN

0 pointstankenmate4d ago0 comments

This decision long predates Linux. It's been a staple back to the earliest days of Unix; and it isn't a weird decision if you take into consideration of multi user systems in office environments that have non trivial security considerations (for example telecoms companies), which is exactly where Unix came from.

0 comments

wartywhoa234d ago

Well, if leaking the length of the password is such a big deal, why not just use a reasonably long password?

Moreover, if someone can see the number of asterisks on the screen, what prevents them from seeing the actual keys that are being pressed?

tankenmateOP4d ago

Again looking back at the history of Unix, it used a 56 bit variant of DES encryption that used the user's password as the key. So only the first 8 characters of the password were used and the rest was silently unused, for example "password" and "password123" would have been the same password on early Unix. And although most BSDs and Linuxes moved in the mid 90s to PAM (and hence md5, etc) most SVR4s didn't move until late in the 90s. And at the other end, DES crypt() made its way into Unix in some v6s (~1977) and became widely available in the release of v7 Unix. So 8 character passwords were a thing for about 20 years.

LtWorf3d ago

My lab at university was like this, well into the 2000s. I remember a guy just smashing keys on his keyboard and then the login worked and I was amazed at how complex his password was and how he could manage to type it that fast

drooopy4d ago

I liked how the IBM Lotus suite hid password input behind a randomly-generated number of asterisks per key press.

LorenDB4d ago

Or listening to the number of keystrokes (although you can add random characters and then backspace to help mitigate this).

oldestofsports4d ago

Video cameras are a thing too

sandworm1014d ago

It was also a time when not every employee had their own computer. It was very normal for pairs or groups of people to all huddle around a machine while working through a problem. It was also common to have someone behind you waiting for their "turn" to use the machine for their project.

indrora4d ago

It was directly a result of some of the choices made by Bell and plausibly Teletype.

Early switching computer systems that had user accounts at Bell also didn't echo back for passwords as some terminals were mixed-duplex, from what I've gleaned in the very odd corners of ESS systems. I suspect the idea is that the model they were working from were touchtone telephones and rotary phones, so numeric passcodes were the standard, and you heard & saw those already? Less noise on paper tapes? The possible list of options goes on and on.

Bell Labs was... Different than your average office or telco environment, I should add.

But that's a swag at best today, without knowing the people that worked on it.

j / k navigate · click thread line to collapse