The first computer password, and the first password theft

The story

In the early 1960s, MIT built the Compatible Time-Sharing System (CTSS), which let many researchers use one large computer at the same time. Each person got a limited allowance of computer time, and each had private files. To keep allowances and files separate, the team led by Fernando Corbató gave every user a password.

It did not take long for someone to find a way around it. In 1962, a researcher named Allan Scherr wanted more computer time than his allowance gave him. He found that he could request a printout of the file that held every user’s password, and did. He then shared the passwords with others, and some used them to log in as other people.

Scherr admitted it decades later, as a light-hearted confession. By then, the problem he had found was everywhere.

Why it mattered

Passwords were created to share a computer fairly, and the first theft came almost at once, by printing the one file where they were all kept. Keeping every password in a single readable place has caused break-ins ever since, which is why modern systems scramble passwords before storing them.

The lesson today

The first password system failed for the same reason many still do: every password was stored in one place, and getting that one file meant getting everyone’s access.

Today, password lists stolen from websites are sold and tried against other sites, because so many people reuse passwords. The answers that work are the ones that do not rely on the password alone:

• A different password for every account, kept in a password manager.
• Multi-factor authentication, so a stolen password is not enough on its own.