Who Invented Computer Passwords? (And the Guy That Made Them Suck)

TL;DR

Fernando Corbato is widely credited with implementing the first known electronic-computer password system on MIT’s Compatible Time-Sharing System in 1961, though he believed IBM’s 1960 Sabre system may have used passwords earlier. CTSS stored passwords in plain text, enabling Allan Scherr to print and share them in 1962. Read on to see how early password design, theft, and accidental exposure shaped computer security.

Transcript

Something akin to passwords have seemingly been used for at least as long as humans have been recording history. For example, one of the earliest references to something like a password is mentioned in the Book of Judges, which was first written down sometime around the 6th or 7th century BC. Specifically, it states in Judges 12: And the Gileadites... Read More

Key Insights

• 🛀 Passwords have been used for centuries, showing their importance in identifying individuals.
• 🔑 Early password systems had security flaws, such as storing passwords in plain text and using weak encryption.
• 👤 User behavior and the psychology behind password choices greatly impact security.
• 🤑 Changing recommendations in recent years suggest the use of longer, simpler passwords rather than complex ones.
• 🔑 Password management software and practices, such as using different passwords for different systems, can greatly enhance security.
• 😷 System administrators should only ask users to change passwords when there is a known breach.
• 🪡 Data breaches continue to occur, highlighting the need for improved security measures, including better encryption and secure storage methods.

Questions & Answers

Q: Who invented computer passwords?

Fernando Corbato is widely credited with implementing the first known password system on an electronic computer. He introduced it on MIT’s Compatible Time-Sharing System in 1961 so multiple users could protect their private files.

Q: Was Fernando Corbato definitely the first person to implement computer passwords?

Corbato was hesitant to claim absolute priority. He suggested that IBM’s Semi-Automatic Business Research Environment, built in 1960, probably used passwords, but IBM was unsure and no surviving record confirmed it.

Q: Why were passwords added to MIT’s Compatible Time-Sharing System?

CTSS had multiple terminals shared by multiple people, while each person had a private set of files. Corbato described an individual password as a straightforward lock for protecting those files.

Q: What was wrong with the first computer password system?

CTSS stored every password in plain text, creating a major security weakness. Anyone who obtained the master password file could read and use all of the credentials directly.

Q: Who was the first known person to steal computer passwords?

Allan Scherr, a PhD student, became the first known person to steal computer passwords when he obtained the CTSS password file in 1962. He admitted his responsibility almost half a century later.

Q: How did Allan Scherr steal the CTSS passwords?

Scherr submitted a punched-card request asking the system to print the password files offline. He made the request late on a Friday night and collected the printout from the file cabinet early Saturday morning.

Q: Why did Allan Scherr steal and share the password list?

Scherr wanted more than his allotted four hours of daily computer time. He shared the password list to obscure his involvement, while others used the credentials for extra machine time or to leave insulting messages in other users’ accounts.

Q: What happened during the 1966 CTSS Password Incident?

An administrator accidentally mixed up the welcome-message files and the master password file. As a result, every password on CTSS was displayed to users attempting to log in, forcing the staff to spend hours changing passwords.

Summary & Key Takeaways

• Passwords have been used since ancient times, such as the use of passphrases by Roman legionaries to identify friends or foes.

• In modern times, the first electronic computer password system was implemented in 1961, but it had security flaws, including storing passwords in plain text.

• The recommendations for creating passwords, such as using special characters and changing them regularly, have been found to be ineffective and burdensome for users.