The first stolen computer passwords came out of a printer

Allan Scherr needed more computer time. The password file was printable. Somewhere between those two facts, MIT’s time-sharing system acquired a very literal paper trail.

Scherr told the story in the CTSS fiftieth-anniversary commemorative overview, which collects accounts from people who built and used the system. His research involved detailed simulations of time-sharing performance. His allocation, he recalled, was “something like 4 hours of processing time” per semester. That is a tight computing budget even before the printer gets involved.

The initial workaround went straight into the operating system. Because Scherr had embedded measurement code there, he could arrange for his recorded usage to return to zero. Think of a parking meter whose owner also has access to the clock mechanism. Waiting for the meter to expire becomes an optional part of the experience.

Then the staff needed the space occupied by his measurement programs. His ability to modify the operating system went away, too. In Scherr’s telling, that happened in spring 1962. The neat little accounting trick suddenly needed credentials to keep working, which gave a file called UACCNT.SECRET an audience it probably did not need.

Scherr described an offline service that accepted a punched card containing an account number and filename. He requested the password file late on Friday and retrieved its listing early Saturday. No password-guessing contest was required; the machine had already done the typesetting (how considerate).

The filing cabinet matters as much as the filename. An interactive account can enforce a boundary while a service beside it quietly carries the same information out on paper. Reviewing only the login screen would miss the place where the credentials actually changed hands. The printer had become a second front door with considerably less ceremony.

Scherr’s version also resists the tidy legend of one brilliant attack. His earlier accounting modification explains why he wanted system access back, and his account describes sharing the method with other researchers. The pressure came from a real research workload and a limited allocation, with trust spread across several services.

A replacement login mechanism alone could leave an equivalent printing path wide open. The useful question for anyone operating a shared service is where its sensitive output goes after authentication has finished. That review can be very ordinary: who can request the export, who can collect it, and whether the requested file gets the same restrictions as an interactive read.

Scherr eventually confessed at a CTSS anniversary gathering. His account ends with reassurance that his doctorate would survive. The password list had already had a much more eventful trip.

The printer had excellent recall.