This paper discusses lessons learned from a selection of computer security problems that have surfaced in the recent past, and that are likely to show up again in the future. Examples are taken from security advisories and from unpublished loopholes in the author's own work. Widely-known passwords Imagine that you choose a password to protect your systems and then advertise that password in big neon signs for all to see. That would not be a very responsible thing to do. Surprisingly, this is almost exactly what some programs have been doing for a long time.
Passwords are the traditional method to authenticate users to computer systems.
Exam- ples that will be discussed in this paper are Kerberos tickets, X11 magic cookies, and NFS file handles. These password tokens or cryptographic keys are not chosen by people. Unfortunately it is easy to end up with a predictable result. In order to understand the problem it is not necessary to go into the details of how Kerberos works. The problem is with the generation of encryption keys.