3 ms·

I too am interested to see how long it takes assuming the attacker knows the generator ruleset (which he will have had to work out previously from two plaintext

by ythn 10y ago

I too am interested to see how long it takes assuming the attacker knows the generator ruleset (which he will have had to work out previously from two plaintext passwords of mine). Still, I don't think it's that easy to figure out the ruleset of a good password generator if you make it obscure enough. For example: Amazon: NovemberAlphaies12# Facebook: KiloFoxtrototto16& What's the ruleset? Answer: Phoenic alphabet of last + first letter of domain + italian number representing total letters in domain backwards + integer sum of the digits on either side of each digit in the Italian number + symbol representing sum of the digits of the previously calculated integer repeated until reduced to one digit. Seems like way too much work for an attacker to try to figure out.

shaftway 10y ago
Frankly, the phonetics were trivial. So it's really... Amazon: ies12# Facebook: otto16& "Otto" made me think 8, and that led me to "sei" (I read stuff upside down when reading to my kids, so I flip letter orders easily). It didn't take long to figure out those were the length of the site. So now we're down to.... Amazon: 12# Facebook: 16& These follow a pattern (digit digit symbol), so even if I didn't notice that the symbols were only those above digits There are about 2000 possible choices. Or 11 bits of entropy. I didn't understand your number scheme, but I probably don't need to.
- tripzilch 10y ago
  Yup that wasn't hard at all. Also, security researchers / consultants / ___hats solve these kinds of puzzles all the time for their work and hobby. Friends I have in that business are insanely good at this sort of thing. Because apparently people always think they're so clever. One told me on multiple cases doing whitehat security consulting they studied the desk+office of the sysadmin for a bit (no post-its), pull some Sherlock Holmes magic (I don't know really) and guessed the password in 5-10 tries (no I didn't quite believe it either, but otoh this guy really doesn't like bragging nor had any reason to lie about). Oh and if I understand the number scheme correctly: > integer sum of the digits on either side of each digit in the Italian number that means, when the number is "otto", meaning 8, the "digits on either side" are 7 and 9, which when you sum them, equal 7 + 9 = (8 - 1) + (8 + 1) = 8 + 8 = 16, so it's really a complicated way of saying "double that number" ... :-)
eridius 10y ago
What do you mean by "integer sum of the digits on either side of each digit in the Italian number"? Your italian number is a word, not a sequence of digits. It looks to me like that number is really just the number of letters in the domain multiplied by 2. And the rest of that password scheme is actually rather trivial to deduce (assuming you can recognize italian numbers).
- ythn 10y ago
  It's a word that represents a series of digits. "Otto" represents 8, tredici represents 13, etc
  - eridius 10y ago
    Yes, I know that Otto is Italian for 8. But even if I convert the italian word to the number, it doesn't make sense, because "8" doesn't have digits on either side of the digit so there's nothing to sum up.
    - ythn 10y ago
      7 and 9 are on either side of 8, and the sum is 16.
      - fiddlerwoaroof 10y ago
        Of course (x-1)+(x+1) = 2x
majelix 10y ago
> Seems like way too much work for an attacker to try to figure out. I dunno, seems like way more work to come up with, maintain, and actually use the generator. Seems easier to just click a bunch in my vault to generate and copy, although I guess you're protected from vault-theft? Given your example, I had already figured out all the way up to ies/otto are probably foreign numbers (more specifically, otto looks like 8 and 16 looks like double of 8) before even seeing that you just gave the answer away.
- sqeaky 10y ago
  Give me some time with him and a $5 wrench an I can "steal" his "password vault" - https://xkcd.com/538/ https://xkcd.com/538/
tempestn 10y ago
Seems like kind of a lot of work to go through every time you want to log onto a site too, compared to just copying and pasting from your vault. (Or using a browser plugin, depending on your personal convenience/security trade-off preference.)

by ythn 10y ago

shaftway 10y ago

Frankly, the phonetics were trivial. So it's really... Amazon: ies12# Facebook: otto16& "Otto" made me think 8, and that led me to "sei" (I read stuff upside down when reading to my kids, so I flip letter orders easily). It didn't take long to figure out those were the length of the site. So now we're down to.... Amazon: 12# Facebook: 16& These follow a pattern (digit digit symbol), so even if I didn't notice that the symbols were only those above digits There are about 2000 possible choices. Or 11 bits of entropy. I didn't understand your number scheme, but I probably don't need to.

tripzilch 10y ago
Yup that wasn't hard at all. Also, security researchers / consultants / ___hats solve these kinds of puzzles all the time for their work and hobby. Friends I have in that business are insanely good at this sort of thing. Because apparently people always think they're so clever. One told me on multiple cases doing whitehat security consulting they studied the desk+office of the sysadmin for a bit (no post-its), pull some Sherlock Holmes magic (I don't know really) and guessed the password in 5-10 tries (no I didn't quite believe it either, but otoh this guy really doesn't like bragging nor had any reason to lie about). Oh and if I understand the number scheme correctly: > integer sum of the digits on either side of each digit in the Italian number that means, when the number is "otto", meaning 8, the "digits on either side" are 7 and 9, which when you sum them, equal 7 + 9 = (8 - 1) + (8 + 1) = 8 + 8 = 16, so it's really a complicated way of saying "double that number" ... :-)

eridius 10y ago

What do you mean by "integer sum of the digits on either side of each digit in the Italian number"? Your italian number is a word, not a sequence of digits. It looks to me like that number is really just the number of letters in the domain multiplied by 2. And the rest of that password scheme is actually rather trivial to deduce (assuming you can recognize italian numbers).

ythn 10y ago
It's a word that represents a series of digits. "Otto" represents 8, tredici represents 13, etc
- eridius 10y ago
  Yes, I know that Otto is Italian for 8. But even if I convert the italian word to the number, it doesn't make sense, because "8" doesn't have digits on either side of the digit so there's nothing to sum up.
  - ythn 10y ago
    7 and 9 are on either side of 8, and the sum is 16.
    - fiddlerwoaroof 10y ago
      Of course (x-1)+(x+1) = 2x

majelix 10y ago

> Seems like way too much work for an attacker to try to figure out. I dunno, seems like way more work to come up with, maintain, and actually use the generator. Seems easier to just click a bunch in my vault to generate and copy, although I guess you're protected from vault-theft? Given your example, I had already figured out all the way up to ies/otto are probably foreign numbers (more specifically, otto looks like 8 and 16 looks like double of 8) before even seeing that you just gave the answer away.

sqeaky 10y ago
Give me some time with him and a $5 wrench an I can "steal" his "password vault" - https://xkcd.com/538/ https://xkcd.com/538/

tempestn 10y ago

Seems like kind of a lot of work to go through every time you want to log onto a site too, compared to just copying and pasting from your vault. (Or using a browser plugin, depending on your personal convenience/security trade-off preference.)