Chapter 1 · 1961–1962

The room divider

The password was born to stop colleagues snooping, not enemies attacking. It lasted months before a grad student printed the whole file.

Start in a room with one computer and too many people who need it. At MIT around 1961, the Compatible Time-Sharing System — CTSS — let many researchers use one machine at once, each from their own terminal, each with their own files. That word “own” created a problem computing had never had before. On a batch machine, your program ran alone. On a time-sharing machine, your files sat next to everyone else’s, and any terminal could wander into any directory.

Fernando Corbató, who led CTSS, added the obvious fix: a password on each account. And here’s the founding fact of this entire site, in his own framing — it wasn’t meant as serious security. It was meant to keep colleagues from poking through each other’s work. Enough to stop casual snooping between people who shared a lab and a coffee pot. A room divider, installed in a shared office. Nobody was threat-modeling foreign intelligence services. The threat model was Dave, from down the hall, being nosy.

Judge the design by its job and it was fine. Judge it by what the world would eventually load onto it — bank accounts, medical records, power grids — and you understand the next sixty-five years.

The divider fell over almost immediately, and the way it fell is a whole education. Allan Scherr was a PhD student rationed to four hours of machine time a week, and his research needed more. He noticed something nobody had thought about: the passwords all lived in a file, and the file was just a file. So he submitted a routine offline print request for it — the 1962 equivalent of asking the front desk to photocopy something — and the system, having no reason to say no, printed every password on the machine. Scherr got his extra hours by logging in as other people. He shared the printout with friends. One of them used the lab director’s password to leave taunting messages in his account.

Walk through it below, stage by stage, because the first password breach in history contains almost every future one in miniature. There was no cracking. No genius. The system protected the doors and forgot the file — authentication was guarded, but the stored secrets weren’t. Every breach headline you’ve ever read where “the password database was taken” is Scherr’s punched card, scaled up.

Two things about the aftermath deserve their place in the record. First: nothing happened. Scherr wasn’t caught for decades, and when he finally confessed — cheerfully, at a reunion, statute of limitations comfortably expired — it was a funny story. There was no incident response because there was no concept of an incident. Second, and stranger: the fix wasn’t to rethink the design. The fix, then and for years after, was to keep the room divider and guard it a little harder.

Here’s the frame to carry through everything that follows, because this site’s argument starts now. The password is a security control — a real one, and it can be a strong one. But its strength was never in the secret itself. A secret is just a string; Scherr printed a whole file of them with zero effort. The strength is in everything wrapped around the secret: how it’s stored, who can reach the file, how it travels, what backs it up, what happens when it leaks. In 1961 none of that existed, so the control was worth one punched card.

The rest of this story is the industry building that wrapping — layer by layer, usually one breach after it was needed. The first layer arrives in chapter 2, from the same building that gave the world Unix: if you must keep a file of secrets, make the file worthless to steal.