3 ms·
I don‘t understand. The website states: „He‘s not allowed to reply without human approval“. The faq states: „How do I know if my injection worked? Fiu respond
by Tepix 8mo ago
I don‘t understand. The website states: „He‘s not allowed to reply without human approval“.
The faq states:
„How do I know if my injection worked?
Fiu responds to your email. If it worked, you'll see secrets.env contents in the response: API keys, tokens, etc. If not, you get a normal (probably confused) reply. Keep trying.“
- the_real_cher 8mo agoHes not 'allowed'. I could be wrong but i think that part of the game.
- cuchoi 8mo agoisn't allowed but is able to respond to e-mails
- Sayrus 8mo agoIt probably isn't allowed but is able to respond to e-mails. If your injection works, the allowed constraint is bypassed.
- cuchoi 8mo agoyep, updated the copy
- tgtweak 8mo agoCan you code up a quick sqlite database of inbound emails receieved (md5 hashed sender email), subject, body + what your claw's response would have been, if any. A simple dashboard where have to enter your hashed email to display the messages and responses. I understand not sending the reply via actual email, but the reply should be visible if you want to make this fair + an actual iterative learning experiment.
- gunapologist99 8mo agomd5 is trivial to brute force.
- TheDong 8mo agoNo it is not. You would need an md5 preimage attack to go from md5sum to email (what I assume you mean by 'brute force') To prove my point, c5633e6781ede1aea59db6f76f82a365 is the md5sum of an email address. What's the email address? If the attacker already knows a given input email ('foo@gmail.com'), then any hash algorithm will identically let them see the emails. The problem with the above proposal isn't related to hashing, it's that the email address is being used as a password to see sent contents, which seems wrong since email addresses are effectively public.
- tgtweak 8mo agoIt ads provability without leaking emails were someone to share a hash for validation sake. Plus anyone can hash their email for a quick access key. It also makes it possible to publish the dataset later without leaking emails.
- gunapologist99 8mo agoYou’re ofc technically correct about preimage resistance in the abstract, but that’s not the relevant threat model: MD5 preimage over a uniform 128-bit space is infeasible. Emails are not uniform 128-bit values. They’re low-entropy, structured identifiers drawn from a predictable distribution. Attackers don’t search 2^128. They search realistic candidates. Emails are lowercase ASCII, structured as local@domain, domains come from a small known set, usernames follow common patterns, and massive breach corpora already exist. If you’ve ever used John/Hashcat, you know the whole game is shrinking the search space. Given a large dataset of MD5(email): Precompute common emails, generate likely patterns, restrict by known domains, use leaked datasets, distributed GPU it. I.e, relatively cheap if the attacker already suspects a specific email, MD5 gives them a perfect equality test. That alone kills privacy. So unsalted MD5(email) is not protection. It’s a stable public identifier that enables membership testing, cross-dataset linkage, re-ID, and doxxing. Academic preimage resistance can still hold while real-world privacy absolutely does not. It's not about breaking MD5’s math, but more about attack economics and low-entropy inputs. To your point, this problem exists with any bare hash. Salt slows large-scale precomputation, but it doesn’t magically add entropy to predictable identifiers.
- cuchoi 8mo agoHi Tepix, creator here. Sorry for the confusion. Originally the idea was for Fiu to reply directly, but with the traffic it gets prohibitively expensive. I’ve updated the FAQ to: Yes, Fiu has permission to send emails, but he’s instructed not to send anything without explicit confirmation from his owner.
- therein 8mo ago> but he’s instructed not to send anything without explicit confirmation from his owner How confident are you in guardrails of that kind? In my experience it is just a statistical matter of number of attempts until those things are not respected at least on occasion? We have a bot that does call stuff and you give it the hangUp tool and even if you instructed it to only hang up at the end of a call, it goes and does it every once in a while anyway.