The World’s First Computer Troll: Password Lessons for Business Owners

Hackers & Hooks | Season 1, Episode 7

In the spring of 1962, a researcher at MIT ran out of computer time. His fix was simple: he asked the computer to print out everyone’s passwords. It did.

On this episode of Hackers & Hooks, Nick Gipson and Isaac Reed tell the story of Allan Scherr, the man the episode calls the world’s first computer troll, and why the problem he exposed is still with us more than 60 years later: passwords are often easier to steal than people think.

One Computer, Many Users, and a Very Revealing Printout

In the early 1960s, computers were huge, expensive machines that filled a room, and everyone had to take turns. MIT’s answer was CTSS, the Compatible Time-Sharing System, first demonstrated by Fernando Corbató’s team in 1961. CTSS let many people share the same machine by giving each person an account, a password, and a set amount of computer time. It is widely credited as one of the first computer systems to use password logins.

Scherr, a Ph.D. researcher running computer simulations, needed more time than his allotment allowed. According to his own later account, he found that CTSS would print files offline if you submitted a request on a punched card, and nothing stopped him from asking for the password file. He submitted the request late on a Friday night and picked up the printout early Saturday morning.

With the list in hand, he used other people’s accounts to get more time. To muddy the trail, he shared the passwords with others. Scherr later said some of them used the passwords for extra machine time, while others logged into colleagues’ accounts just to leave insulting messages. Administrators put the problem down to a bug, and Scherr did not admit his role until decades later.

As Isaac put it, it was not really sabotage. Exploring the system was part of the culture among students at the time. But as Nick explained, the effect was the same as a breach: once passwords were out, nobody could be sure who was using whose account, and the time-sharing system stopped being fair.

“Your password probably shouldn’t be whatever day of the week it is, right? It shouldn’t be your pet’s name.”

Isaac Reed, Hackers & Hooks

What Went Wrong: The Keys Were Sitting in Plain Sight

CTSS kept its passwords in plain text, meaning anyone who could read the file could read every password. The system simply assumed nobody would ask for that file. Scherr asked. A few years later, in 1966, an administrator’s mistake swapped the password file with the system’s daily welcome message, and every user who logged in saw everyone’s password. CTSS engineer Tom Van Vleck later recalled that incident as the source of the idea of storing passwords in a one-way scrambled form, so a system can check a password without keeping a readable copy.

The hosts point out that businesses are still fighting the same battle. Even with extra layers like multi-factor authentication and passkeys, most systems still come down to a secret that can be guessed, stolen, or tricked out of someone. Today the stakes are much higher than stolen computer time. Nick’s example is a cloud account: someone with stolen access could run computing jobs on your bill, which can add up to a lot of money, and the same access can expose sensitive data. A stolen email password can lead to fake invoices, redirected payments, and customers who receive fraudulent requests from an address they trust.

The fishing segment came from a kids’ fishing birthday party at Nick’s house: lots of young anglers, one dock, shared bait and poles, and more tangled lines than anyone could count. Nick saw the parallel right away. Like the CTSS users in 1962, everyone was sharing limited resources, and things got messy fast once people stopped staying in their own spot. His other takeaway was that the simplest setup often works best, on the dock and with passwords.

“I’ve worked on some of the most expensive, most highly budgeted projects that are in our world today, working for the government. And I will take a really good user training program over all of that.”

Nick Gipson, Hackers & Hooks

Lessons for Small Businesses

• Use a password manager. Long, unique passwords for every account are only practical with a password manager. It removes the temptation to reuse one password everywhere or fall back on something easy to guess.
• Turn on multi-factor authentication where it matters most. Multi-factor authentication (a second check, such as an app prompt or a physical security key) means a stolen password alone is often not enough. Start with email, banking, payroll, and cloud admin accounts.
• Give every person their own login. Shared accounts make it impossible to tell who did what, which is exactly how Scherr’s trick blended in. Individual accounts make unusual activity easier to spot and investigate.
• Never store passwords in plain sight. No spreadsheets named “passwords,” no sticky notes on monitors, no printouts in a desk drawer. If a file or system holds credentials, limit who can open it.
• Review who has access. When people change roles or leave, remove their access the same day. Check admin accounts on a regular schedule.
• Train your people. Short, regular training on phishing and password habits is one of the most practical investments a small business can make, and Nick would choose it over a bigger tool budget.

How Gipson Cyber Helps

Good password habits reduce risk, but stolen credentials still happen. When they do, the warning signs often show up as unusual sign-ins, new email forwarding rules, or access from places your team has never been. Gipson Cyber’s Business SOCaaS provides 24×7 monitoring by real human responders who watch for that kind of activity across the tools you already have. That is what SOCaaS for small business should look like: people paying attention, working alongside your IT team or MSP rather than replacing them, and clear reporting on what they find.

If an account has already been taken over, Business DFIR provides business email compromise response and broader incident response, helping you understand what happened and what to do next. If you think you are being hacked right now, go to 800cyber.com.

No password rule or monitoring service can stop every attack. The aim is to make stolen passwords less useful to an attacker and to notice sooner when one is being misused.