4 ms·

Wow. This is going to be interesting... The page even includes the key to decrypt the encrypted fields in the dump. Is pg_crypto that easy to crack, or is it mo

Wow. This is going to be interesting... The page even includes the key to decrypt the encrypted fields in the dump. Is pg_crypto that easy to crack, or is it more likely the key was stored somewhere in plaintext (e.g., email, pdf, etc.)?

ascendantlogic 11y ago
One would assume the key was simply pilfered as well vs the crypto being cracked, but that's just a gut reaction. Human opsec is almost universally worse than any crypto, even ones that have already been broken.
- travjones 11y ago
  That's what I suspected. Thanks.
infogulch 11y ago
The key is "Nipper47". Only 8 characters in the standard "short english-ish word starting with a capital letter followed by a couple numbers"-pattern. I'd say it's less that pg_crypto is easy to crack, and more that the key is trivially insecure and easy to brute-force. But sibling is probably right that it was just sitting there.
- _asdf_asdf 11y ago
  8 chars, including numeric, uppercase and lowercase... With sufficient GPU resources (being in possession of a working rig, cloud-based or standalone and air-gapped, all powered-up and running operable software) and talent (experience, and familiarity with an existing framework and an established code base), I'm thinking one person could brute force that, in the privacy of their own home, in a trivial amount of time.
  - infogulch 11y ago
    > one person could brute force that, in the privacy of their own home, in a trivial amount of time. Yes. And that's assuming your pattern (26+26+10)^8 ~ 2e14, but the basic character pattern here is 26 * 26^5 * 10^2 ~ 3e10, almost 10000 times weaker. This is an extremely common pattern, most passwords don't follow a uniform distribution of those "numeric, uppercase and lowercase" characters.
    - ikeboy 11y ago
      Or if nipper is in your dictionary (likely, there's a wikipedia page with that title and there's only a handful of million articles, trivial to add every title, or even every word), then assuming a dictionary of 10 million words, the pattern is 2e710*10, another order of magnitude reduction.

ascendantlogic 11y ago

One would assume the key was simply pilfered as well vs the crypto being cracked, but that's just a gut reaction. Human opsec is almost universally worse than any crypto, even ones that have already been broken.

travjones 11y ago
That's what I suspected. Thanks.

infogulch 11y ago

The key is "Nipper47". Only 8 characters in the standard "short english-ish word starting with a capital letter followed by a couple numbers"-pattern. I'd say it's less that pg_crypto is easy to crack, and more that the key is trivially insecure and easy to brute-force. But sibling is probably right that it was just sitting there.

_asdf_asdf 11y ago
8 chars, including numeric, uppercase and lowercase... With sufficient GPU resources (being in possession of a working rig, cloud-based or standalone and air-gapped, all powered-up and running operable software) and talent (experience, and familiarity with an existing framework and an established code base), I'm thinking one person could brute force that, in the privacy of their own home, in a trivial amount of time.
- infogulch 11y ago
  > one person could brute force that, in the privacy of their own home, in a trivial amount of time. Yes. And that's assuming your pattern (26+26+10)^8 ~ 2e14, but the basic character pattern here is 26 * 26^5 * 10^2 ~ 3e10, almost 10000 times weaker. This is an extremely common pattern, most passwords don't follow a uniform distribution of those "numeric, uppercase and lowercase" characters.
  - ikeboy 11y ago
    Or if nipper is in your dictionary (likely, there's a wikipedia page with that title and there's only a handful of million articles, trivial to add every title, or even every word), then assuming a dictionary of 10 million words, the pattern is 2e710*10, another order of magnitude reduction.