Re: AOLServer, Are you thinking of Jay Satiro (Ref: http://justinakapaste.com/from-o0o-of-aol-files/) ?

The author implies that the whaops hackers had their own malware, written in Delphi, to do the on-lan redirection.

paste did not hack anything he is just an archivist of aol lore. my pr0gz are on there i found them while searching for {s gotmail to add to my phone alert notifications. we follow each other on twitter and he's just a wholesome dude with no sketchy background other than writing vb pr0gz with the rest of us in aol://2719-2-2-vb

I was referencing the content of the post and its discussion of Jay Satiro’s felony convictions. The domain looks to be a great archive of old AOL things.

Oh yeah you are right no jumped to conclusions. Nice link there, the AOLserver tho was just a web server, not the whole server framework or OS. https://github.com/aolserver/aolserver It was written by some company that we bought. It was also the basis for Greenspun’s excellent book on database backed web sites.

Yeah, and on rereading the original article, the hack was just guessing the passwords to admin AIM accounts. I hope it wasn’t mine! From my perspective that is “works as designed”. I don’t think the TFA was ever put into AIM login, but it was all a while ago. But anyways, nice to seem one of the dumb names I came up with in the press. I also wrote wam (web authentication module), Hermes (messenger of the Gods - like buddy list but where users could add data sources to the list, with filters or alarms), Ewoks (“external web Oscar knowledge server”, an http server that allowed for easy integration into the server message framework we used) and re-wrote morf “master Oscar registration facility”. The original was a custom written no-SQL DB and we moved it to Sybase with sharding.). All C. All event loop based. All really solid infrastructure written by people doing it for the third time. Fun times. Had an actual agile process and brought the coolness of the internet to many people for the first time.

you're talking about cameron "cam0" lacroix who got that and a default ssh key. he was raided on frederick street for that at age 14, but being a minor and a legend at opssec he was not charged or arrested - just raided for good measure by bill zaleski (sp) at 703.265.4040 :)

two factor authentication in 2005?

Back in 2000 or so, it seemed a status symbol of how many RSA tokens you had on your keychain. The more you had, the more important systems you had access too.

Don't forget that PayPal's original idea was a Palm Pilot app that replaced all those pesky hardware tokens.

Ha, cool. How many tokens did you ever see at once? :D

Presumably PayPal were intending to do an app + hardware module - or was this essentially "LeT's MaNaGe RSA KeYs UsInG NoN MeMoRy PrOtEcTeD CoMmOdItY HaRdWaRe RuNnInG a NoN SaNdBoXeD KeRnEl"?

According to _Founders at Work_, they just reverse-engineered the keys and emulated them on a Palm Pilot

> "LeT's MaNaGe RSA KeYs UsInG NoN MeMoRy PrOtEcTeD CoMmOdItY HaRdWaRe RuNnInG a NoN SaNdBoXeD KeRnEl"

In retrospect, this would have been at least as good as the real securid dongles.

Yeah physical tokens from RSA (I think) We even rigged up CVSD so you couldn’t push code without the rsa token for each push. (Not actually sure anymore that CVS commit to remote was called push).

I had a family member working for an AOL call center around that time, the physical token they had was from RSA. At least at the time, it was required for nearly anything, including logging into the customer desktop application.

I didn't use it myself, but I've heard "check in" used colloquially for what seems to be `cvs release`.

All I remember is having to look at each file and figuring out if the diff between 1.13.0.4 and 1.13.0.5 should be applied to 1.16 and then for the next file it was 1.15.1.2 and 1.15.1.4 and so on for each file. That was after AOL had slowed down to the point where you didn’t just release each change but batched they up into releases called QARs (QA Requests where you documented all the changes and stuff to test etc.). So earlier, merging from released point fixes back to the latest version wasn’t common and cvs wasn’t good at it. Later it was more common and what now is a two minute git pull —rebase was a half day.

Also by then, the super genius software folks started getting replaced by MBAs who would rather developers be idle than work on stuff that wasn’t prioritized.

Two factor auth (password + RSA token) was used for vpn/ssh from home and to access high security stuff (which I never got access to) at Yahoo when I joined in 2004. If AOL was having trouble with security, requiring it for admin tools would have been reasonable and feasible in 2005.

Netscape used RSA SecurID tokens when I joined in 1996. I still have kine, but the battery long since expired.

Presumably you can get a new watch battery for it, non?

The tokens are not intended to be servicable. Even if you replaced the battery, you couldn't set the time, so I don't think you could sync your token and your verifier.

And I don't know if these things had protections against being opened anyway.

The worst part about doing operations with the RSA tokens is that you can only use each code one time and it takes a full minute to get a new code.

Waiting for the code to roll to get through a couple jumphosts is pretty excruciating.

Earlier than that (at least as far back as 2003, my memory is hazy but it might have been 2001) I was using RSA based tokens for TFA to access on-prem systems at a couple of our clients for product support purposes. At least one of those was significantly smaller than AOL would have been in 2005. So the tech was readily available and had been for some time, AOL had the resources to scale it out to their key infrastructure, and after a significant hack I can believe that even in those relatively naive days there would have been plenty enough management impetus to Make It Happen.

my bank used 2FA (auth codes or so called "transaction codes" send in physical mail to approve transactions) in the late 90s early 2000s. so 2fa isn't some new invention, funny how it took basically 2.5 decades until it become quite mainstream... now that i think of it, it's actually quite concerning that 2fa didn't have widespread adoption earlier - as soon as smart phones became common.

Besides RSA tokens which sibling comments have already mentioned, smartcards were also used for 2FA back then.

The old style tokens were widely in use in the late 90s through to the early 2000s.

https://en.wikipedia.org/wiki/RSA_SecurID

Definitely used one up to 2013 and only stopped because I left the company.

My bank even had me use one of those until 2009 or 2010!

they had 2fa before most orgs and even launched a beta for the public called "AOL PASSCODE". aim had 2fa i remember host guide something with the password "pepper" had it in 2002.

I had RSA two factor at an .edu in 2000, and they were there for a while. We called em “enigma cards”.

was common in some parts of finance also, as i recall this pre-2008. folks had pager-looking things that flashed OTPs. i think bloomberg terminals were partially responsible for driving the use of 2fa.

World of Warcraft players were using it in 2008.

I do remember that. Little key fobs with one time codes. But that's still 3 years later. But apparently according to some of these comments large tech places were using 2FA in 2000 and as early as '98 or '99 which still surprises me, not really having seen it become ubiquitous until recently, and really only around things for banking and purchasing.

I've used 2FA in the 90s.

What did you use it for? Work?