# Question about Passwords - Is XKCD right? **URL:** \ **Category:** Factual Questions\ **Created:** [July 2, 2022, 2:27pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301 "2022-07-02T14:27:00Z")\ **Posts on this page:** 20\ **Page:** 9
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [July 12, 2022, 5:32pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/162 "2022-07-12T17:32:28Z")
Flashing back to summer of 1998: Dave and I, and a few other undergrads, were working on a research project for one of the professors, who also happened to be the administrator for all of the workstations we were working at. Dave had just finished putting together his data-analysis program, and had just hit enter to start it on its first run. Meanwhile the professor had been watching from the other side of the room, and just as he hit enter, his computer played a sound clip: “I’m sorry, Dave, I can’t let you do that”. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [July 12, 2022, 6:28pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/163 "2022-07-12T18:28:18Z")
Not quite as good, and not \*nix-related, but more frequent, at least for me … Back in about 1988 I ran a small business. We had a mix of a couple dozen Macs and PCs for different tasks. I _think_ the Macs were IIc models on System 5 upgraded to System 6. Hard to recall now. Anyhow, one of the built-in sound effect themes included an “Uh-oh” that played when an error occurred. Which sounded exactly like my own voice and intonation. It got real tiresome hearing my computer bitch at me in my own voice. The rest of the staff didn’t much care for my audible omnipresence either. 🙂 Worse than HAL telling me it wasn’t going to let me do that, _I_ was telling me I wasn’t going to let me do that. Uggh! ---
**Author:** ![echoreply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/echoreply/32/3641_2.png) [@echoreply](https://boards.straightdope.com/u/echoreply)\ **Post date:** [July 12, 2022, 9:49pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/164 "2022-07-12T21:49:50Z")
> [@pulykamell](#): > > and output messages This would probably have been done using the `write` command. If a ptys were left world writable, then you certainly could do it with `>`, but `write` was the usual method, at least for chatting in computer labs in the early 90s. ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [July 12, 2022, 10:05pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/165 "2022-07-12T22:05:05Z")
It definitely was not _write_. Or rather, that’s not what I used. You could do _echo_, _banner_, _cat_ and I assume other things (you probably could redirect anything with text output like _ls_, but I hadn’t tried). I’ve done all those, and I’ve never heard of the _write_ command, so I’m sure of that syntax. (And I wish I could say I was clever enough to figure this out myself, but I had read about it in some book somewhere.) By the way, the command I had copied had _\>!_ and not just a plain _\>_. What does the exclamation mark do in that context? ---
**Author:** ![echoreply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/echoreply/32/3641_2.png) [@echoreply](https://boards.straightdope.com/u/echoreply)\ **Post date:** [July 12, 2022, 10:53pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/166 "2022-07-12T22:53:30Z")
> [@pulykamell](#): > > What does the exclamation mark do in that context? If the shell variable `noclobber` is set, which limits what files can be overwritten from shell redirects, then just `>` can’t write to a terminal. Using `>!` says not to do those checks this time—so write to the `/dev/pty` (terminal) file with the output of your command. I think if `noclobber` is not set, then `>!` and `>` are functionally the same. This is a `tcsh` (`csh`, too?) thing. ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [July 12, 2022, 11:04pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/167 "2022-07-12T23:04:51Z")
You should be able to pipe whatever you want into `write`. Provided, however, that the recipient enabled write access, e.g., by running `mesg y`. Note that at least some versions of operating systems like ITS embraced the hacker philosophy that passwords were unnecessary, even explicitly logging on was optional; all files were editable by all users, and of course the equivalent of `mesg` was `y`. ---
**Author:** ![Northern\_Piper](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/northern_piper/32/5304_2.png) [@Northern\_Piper](https://boards.straightdope.com/u/Northern_Piper)\ **Post date:** [March 3, 2023, 3:08am UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/168 "2023-03-03T03:08:04Z")
Bump > [@Briny\_Deep](#): > > Both my Lastpass master password and my various Hotmail account passwords are in the Correct Horse Battery Staple format, Lastpass has been hacked; Lastpass Co. denies any harm and sorta says it’s the customers own fault. > **[LastPass data was stolen by hacking an employee’s home computer](https://www.theverge.com/2023/2/28/23618353/lastpass-security-breach-disclosure-password-vault-encryption-update)** > > Attackers accessed customer vault data via the company’s cloud storage. ---
**Author:** ![MrDibble](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mrdibble/32/114_2.png) [@MrDibble](https://boards.straightdope.com/u/MrDibble)\ **Post date:** [March 3, 2023, 6:34am UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/169 "2023-03-03T06:34:53Z")
> [@Northern\_Piper](#): > > Lastpass has been hacked No, Lastpass was _not_ hacked. A Lastpass customer was hacked. Not the same thing. ---
**Author:** ![bob\_2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bob_2/32/3341_2.png) [@bob\_2](https://boards.straightdope.com/u/bob_2)\ **Post date:** [March 3, 2023, 10:23am UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/170 "2023-03-03T10:23:15Z")
I confess that I have not read every post above, but scanning through, I did not see any mention of the way all my financial sites protect me, which is to add some direct contact when they detect a change. I use Ccleaner regularly, and each time my bank wants to send me a code on a pre-registered phone before they let me in. When I lost my phone a few years ago and bought a new one with a different number, they made me wait until they sent me a code in the mail. Even if someone cracks Amazon and finds my password, I assume that will be inconvenient for me but no financial loss. I have three levels of secureness: Financial, Shopping and the rest (forums etc). I simply do not see the need for 300 secure passwords when the worst that could happen is that I get kicked off the SDMB because I use the same password as on trucknet. I do have a password manager. It is an indexed notebook with all the codes and passwords needed to get into all my contacts. If someone steals my tablet and also the book, I will be in trouble. This possibility does not worry me unduly. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [March 3, 2023, 11:11am UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/171 "2023-03-03T11:11:06Z")
> [@MrDibble](#): > > No, Lastpass was _not_ hacked. A Lastpass customer was hacked. From the link: > LastPass says that a threat actor was able to steal corporate and customer data by hacking an employee’s personal computer and installing keylogger malware, _which let them gain access to the company’s cloud storage_. (emphasis added) ---
**Author:** ![MrDibble](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mrdibble/32/114_2.png) [@MrDibble](https://boards.straightdope.com/u/MrDibble)\ **Post date:** [March 3, 2023, 11:53am UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/172 "2023-03-03T11:53:27Z")
Aah, my bad, I misread who “the company” was in there, it’s Lastpass itself, not some client company, apologies @Northern_Piper ---
**Author:** ![md-2000](https://avatars.discourse-cdn.com/v4/letter/m/9d8465/32.png) [@md-2000](https://boards.straightdope.com/u/md-2000)\ **Post date:** [March 3, 2023, 12:53pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/173 "2023-03-03T12:53:12Z")
I remember with VAX (I think it was UNIX) at one time, you could pipe text to other terminals. In those days of budget constraints, the system would get overloaded - so when it was running 100%, you would get bumped off after 1 hour to allow others to logon. Except, the finest minds in the CompSci department came up with the simple technique for limiting load - a process every 5 minutes would pipe a “hang up” to the terminal that had been logged on more than an hour. A terminal printing that would disconnect… until everyone learned that by running a terminal process on your terminal, the result would simply terminate the top process and bump you back to the lower level process. At that point, most students would have a dozen or more nested terminal processes running, and get bumped out of each in turn - which did wonders for the system total load. ---
**Author:** ![Briny\_Deep](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/briny_deep/32/17188_2.png) [@Briny\_Deep](https://boards.straightdope.com/u/Briny_Deep)\ **Post date:** [March 3, 2023, 1:38pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/174 "2023-03-03T13:38:21Z")
Scathing writeup of Lastpass’s ass-covering disclosure back in December: > **[What’s in a PR statement: LastPass breach explained](https://palant.info/2022/12/26/whats-in-a-pr-statement-lastpass-breach-explained/)** > > The LastPass statement on their latest breach is full of omissions, half-truths and outright lies. I’m providing the necessary context for some of their claims. I have an extremely strong master password but it’s not supercool that someone now has a complete list of all my secure websites. That LastPass failed to use encryption for data other than passwords, when they easily could have, is probably a dealbreaker. Time to jump ship. ---
**Author:** ![DesertDog](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/desertdog/32/11503_2.png) [@DesertDog](https://boards.straightdope.com/u/DesertDog)\ **Post date:** [March 5, 2023, 8:03pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/175 "2023-03-05T20:03:01Z")
I’m sort of surprised they had the passwords at all, even encrypted. One job I had, the company had clients with accounts protected by passwords. The actual password was not stored, but a hashcode of it. Thus it was slightly more insecure in that another password guess _might_ render the same hashcode but it made the password database itself more secure because even if it was stolen, it would be worthless. I couldn’t tell you the number of times I had a client begging me to tell him his password and I had to explain I literally couldn’t – all I could do would be to send a password reset link to the email on file for the account. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [March 5, 2023, 8:09pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/176 "2023-03-05T20:09:11Z")
LastPass can’t store just the hashes. They could do that for the password to log into LastPass itself, but the whole point of LastPass is that it’s a way to store your passwords for all of your other sites. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [March 5, 2023, 10:36pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/177 "2023-03-05T22:36:01Z")
The rest of the story is that LastPass stores none of the info that could be used to decrypt your passwords. That info is only in your head and on your devices while they’re actively using LastPass. To be sure the attackers gained a LOT of useful info about their targets. And may be able to target at least some users with phishing attacks to get the decryption password from them. ---
**Author:** ![Saint\_Cad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/saint_cad/32/18907_2.png) [@Saint\_Cad](https://boards.straightdope.com/u/Saint_Cad)\ **Post date:** [March 5, 2023, 10:59pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/178 "2023-03-05T22:59:37Z")
We just had to reset our passwords to 16+ characters and yes the CAP, lowercase & $ymbol rules. My question is: aren’t most passwords compromised by phishing like emails saying “Hey I’m a guy from the IT department. There is some suspicious behavior on your account and I need to verify your password. Send that to me please.” ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [March 5, 2023, 11:06pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/179 "2023-03-05T23:06:33Z")
I don’t know whether it’s “most”, but yes, social engineering attacks like that are and always have been common. I think GMail might now automatically attach warnings to emails asking for passwords, which hopefully helps some. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [March 5, 2023, 11:16pm UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/180 "2023-03-05T23:16:22Z")
The other common email scam is the email claiming a problem with your bank account with a [click here to log in] link that goes to an attacker’s fake look-alike website. If you’re fooled you enter your real bank creds on their website and they say “thank you very much”. To be sure the https protocol itself, and browsers that watch for DNS / certificate mismatches can protect against this kind of thievery. But none of that is foolproof and plenty of end-users are foolish. ---
**Author:** ![md-2000](https://avatars.discourse-cdn.com/v4/letter/m/9d8465/32.png) [@md-2000](https://boards.straightdope.com/u/md-2000)\ **Post date:** [March 6, 2023, 12:26am UTC](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301/181 "2023-03-06T00:26:09Z")
> [@LSLGuy](#): > > The other common email scam is the email claiming a problem with your bank account with a [click here to log in] link that goes to an attacker’s fake look-alike website. If you’re fooled you enter your real bank creds on their website and they say “thank you very much”. To be fair, they would simply simulate a website failure and log you out, close the browser once they have your password details. So rather than getting alarmed and changing your password, you blame it on the vagarities of the Internet tubes, and are none the wiser while they drain your accounts. [Previous page](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301.md?page=8) [Next page](https://boards.straightdope.com/t/question-about-passwords-is-xkcd-right/967301.md?page=10)