10 ms·
There is like... four people I know I could send this to who'd laugh, it's so niche. Yet I also laughed out loud when I got how conventionally impossible it is.
by moritonal 5y ago
There is like... four people I know I could send this to who'd laugh, it's so niche. Yet I also laughed out loud when I got how conventionally impossible it is.
- cco 5y agoAs someone that works at an authentication API company, there are _dozens_ of us who found this hilarious. > Yet I also laughed out loud when I got how conventionally impossible it is. Maybe give it a whirl with https://sha256algorithm.com/ https://sha256algorithm.com/? haha
- eganist 5y agoI ended up crossposting it to the few security rooms I'm in for quick laughs But for what it's worth, this also serves as a great initial CTF-type introduction to how debuggers work in web browsers.
- jerf 5y agoIf the debugger is open, Passwordle automatically breaks the execution right where the answer is determined. Now that's service.
- umvi 5y agoTIL there's a "debugger" keyword[0] in JavaScript that auto-sets a breakpoint at that line. [0] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/debugger https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
- therein 5y agoint 3 of Javascript. I use it all the time because webpacked assets make it hard to find the line of code I am looking for.
- geraldwhen 5y agoIf you build source maps this isn’t a problem.
- Normal_gaussian 5y agoAnd if you're using nodejs woth source maps, but still getting horrid stacks: "--enable-source-maps" > NODE_OPTIONS="$NODE_OPTIONS --enable-source-maps"
- deleted 5y ago[deleted]
- hycaria 5y agothat is so funny, I learned that today too on a completely different page!!!
- jacobkg 5y agoI laughed so hard
- VikingCoder 5y agoWinners never quit. And quitters never win. But those who never win AND never quit are idiots.
- jonnycomputer 5y agoThat's because winners know when not to play.
- redefine_net 5y agoThat means quitters are winners?
- extropy 5y agoNo, winners never quit. Have to be true to your axioms.
- GuB-42 5y ago"Winners never quit" and "quitters never win" are logically equivalent. It mean that you can't quit and win, ie. quit AND win <=> FALSE The truth table is: QUIT | WIN | result -----+-----+------------------ no | no | possible, idiot no | yes | possible, winner yes | no | possible, quitter yes | yes | impossible
- jonnycomputer 5y agoTBH, I think we need at least a first-order predicatelogic to adequately model this. In any case, I'd dispute your logical equivalence. All quitters are not winners. But not all "not winners" are quitters. Some just keep playing and losing. Like I do at chess.
- taberiand 5y agoStrange game
- SMAAART 5y agothis is deep.
- mlyle 5y agoIs it? 6 guesses and I have 14 hex digits (56 bits) of the hash, along with knowing the population counts for all the numbers. This is enough to run a password cracker and determine the plaintext if it's a readily guessed password. Sure, it breaks conventional use of rainbow tables, etc, but... edit: Eh, 14 characters. OK, that's pretty resistant to anything other than debugging.
- deleted 5y ago[deleted]
- residualmind 5y agoHow does that help you when any of your inputs' digest is not related to any other's, not even knowing the target length of the original message? what am i missing?
- residualmind 5y ago[ @some-sober-math-guy insert probabilities ]
- thewakalix 5y agoThe correct password is impossible to calculate from the given data, but it seems like it should be possible to check whether a password matches the data.
- residualmind 5y agoYeah because the algo is known, it is SHA256. The thing is you don't know the length of the password. It could be more than the number of hydrogen atoms in the universe, or 12. You still have to brute force or look up one possible solution (or collision thereof). The whole thing just shows that a hash makes ZERO applicable inferable assertions about the message (password). Thats the definition of evenly distributed hashing functions: change anything in the message, including length, and there will be no identifiable relation between the hashes of one messsage and the next you try,
- JAlexoid 5y agoOh wow! You have a lot of friends!... (unironic self deprecating voice)
- antirez 5y agoYou can easily guess the right sha256 just using random strings and overlapping correct characters and then you can run a dictionary attack on it, or a brute force one if it's not too long.
- MattPalmer1086 5y agoYou get a SHA256 hash of each guess. The hints you get on each guess are useless to help you with the next guess.
- antirez 5y agoNope. Try yourself with a, b, c, d, e, f, g as guesses. You will see that green letters that are coincident will be the same. So to reconstruct the original SHA256 of the password is easy. The problem then turns like every other hash -> password reconstruction: hard if the original secret is hard to guess via dictionary/brute-force, otherwise easy.
- MattPalmer1086 5y agoAh, I misunderstood the point you were making. It's still true that each hash won't help you make the next password guess, but you can iteratively fill in parts of the overall hash. I'm not sure that really helps you much though, as you don't have enough guesses to get the entire hash. And even with that, you may or may not succeed. Still, good point!
- MattPalmer1086 5y agoReplying to self, if the password is based on a dictionary word, then it's much more doable, as you almost certainly don't need the entire hash. I think you made that point too...
- cestith 5y agoYou just need a rainbow table of... 14 character... random passwords... across the allowed symbols. Should be able to build that with Cuda, OpenCL, or OpenMPI in a matter of X weeks given Y hardware budget. Sorry, solving for X and Y is left as an exercise for the reader.
- LeoNatan25 5y agoI laughed. It’s excellent, and great fit for the crowd here.
- masswerk 5y agoWell, it made me laugh. Thanks, that's what the Internet is for! (Namely, amusing content about the technicalities of the Internet.)
- scbrg 5y agoIt's not impossible. I hear Bruce Schneier got the correct hash on the first try. https://www.schneierfacts.com/ https://www.schneierfacts.com/ (Sorry for the very HN:ish post, but I feel it's somewhat in the spirit of this story)
- ben_w 5y agoHah! I don’t get this one, though: https://www.schneierfacts.com/facts/694 https://www.schneierfacts.com/facts/694 Searching for the number gets me Mill’s Constant, but I don’t get the connection to sugar or why it would be repeated.
- areyousure 5y agohttps://youtu.be/5oyZJDBUzWc?t=252 https://youtu.be/5oyZJDBUzWc?t=252
- ben_w 5y agoThanks! I’ve never seen that film :)