Xk

17 ms·

151.
by Xk 16y ago
Brute force? Yes. Rainbow tables? No. That's the purpose of a salt. The table needs to be several orders of magnitude bigger.
152.
by Xk 16y ago
> Gawker saved passwords. You should never, ever store user passwords. If you do, you're storing passwords incorrectly. Always store the salted hash of the password -- never the password itself! Uh, no? They did save the hashed+salted v
153.
by Xk 16y ago
No, that would be 3k of 1.5 million. They would have tried the password '123456' on all of the accounts. EDIT: I just looked at the dataset and about half of them list NULL as the password. ~3000/748,495 = ~.4%
154.
by Xk 16y ago
> A plurality of Gawker Media passwords are six characters long A plurality of brute forced Gawker Media passwords are six characters long. Maybe this statistic is valid for all 1.5 million passwords, but that's quite a lot of extrapo
155.
by Xk 16y ago
> with some sort of visual, non-spoofable indication by the browser, such as the titlebar blinking green or some such thing Then I'd put some secure password box 500 pixels above the top of the page to make the titlebar blink green, and
156.
by Xk 16y ago
Very true. However, there will be someone in the class who knows that "pick up pennies" is just the game of Nim, and will google it. Renaming makes it harder so fewer people will be able to cheat, but it doesn't make it impossible. (That sa
157.
by Xk 16y ago
Agreed, but that all but eliminates graded homework for the first several years of college (not that that's a bad thing, just that I don't think colleges would approve).
158.
by Xk 16y ago
I agree with you for the most part, but nearly all introductory courses must have content that is easily available online. Consider teaching students how to write a recursive method. What would their first assignment be? List length? "find
159.
by Xk 16y ago
I wrote a parser generator, so I'm using that. It's BNF-like.
160.
by Xk 16y ago
Haha, no, I don't have this answering questions for any bot anywhere. Actually, the reason those are solved isn't exactly what you'd expect. When it fails to find an answer, it checks to see if any word is upper-case. If it is, it cuts out
161.
by Xk 16y ago
Very true. The person writing the questions has the advantage in this one because they can always throw in more variations and I would have to figure out all of the new ones. There is, however, an inherit limitation to question-asking, and
162.
by Xk 16y ago
Since some people are asking how it works, I'll explain how some of those work/fail. Q: Which word from list "duckweed, commendations, civilised, receptionists, flours" contains the letter "v"? A: FAILURE This one fails because it recognize
163.
by Xk 16y ago
Right now there's no API or anything -- I wrote this just to see if I could. I'm not sure if I'll be putting up an API, because I figure by the time I'd do that I can just release the source for it. But if you really wanted I probably could
164.
by Xk 16y ago
Yeah :) But then it occurred to me that someone could solve one by hand, and then use that answer to solve five more captchas that I asked for, and then recurse, eventually solving thousands of a site's captchas.
165.
by Xk 16y ago
You are correct, I look for a pattern and apply very very basic logic. I just got 1,000 questions from the demo page and looked how they were similar. For example, there are many questions of the form "[list of something]: the [ordinal numb
166.
by Xk 16y ago
They don't give questions formatted in other ways, so I didn't include that in the logic. As someone else pointed out, even deleting the question mark would break it. (However, making the question mark optional would be a two second fix.)
167.
by Xk 16y ago
Sure. I'm assuming you know what parsing is, and what syntax-directed translation is. If not, the wikipedia articles ( http://en.wikipedia.org/wiki/Parsing and http://en.wikipedia.org/wiki/Syntax-directed_translation ) offer a reasonable
168.
by Xk 16y ago
There are a few types of questions that it doesn't solve. I only had so much time yesterday and so I didn't put in all the different types of questions. Maybe later I'll go back and get all the questions that it can't solve.
169.
by Xk 16y ago
For a class in college I had to write a parser-generator, so I'm using mine.
170.
by Xk 16y ago
I replied to another comment, but since this one is getting upvoted I'll reply here too: I do not want to publish the grammar file yet . Later on, yeah, I can do that. But for now I want to leave it up to the people who run this service to
171.
by Xk 16y ago
Haha, yeah. I did it so that people wouldn't use it as a spamming service: I wanted to show that those captchas can be broken, but without any harm to anyone else.
172.
by Xk 16y ago
Just letting people know I dropped it from 10 questions down to 5 because right now it's a free google app and I'd rather not pay for CPU-time.
173.
by Xk 16y ago
Yeah, but I have the advantage of knowing all the forms of the questions. If you were to change one word then mine would break. Or misspell anything.
174.
by Xk 16y ago
I'd like to wait a little bit to see if Rob (who it seems runs the site) will make it a little better. There are people who use this service and I don't think it would be right to let spammers attack them. Granted, it wouldn't be hard for s
175.
by Xk 16y ago
I had yesterday off and so spent four or so hours writing this. I haven't made it recognize all of the cases. It still gets a few wrong, but usually it'll just say FAILURE when it can't solve it. As the page says, it's just a ~300 line gram
176.
I broke textCAPTCHA with Python(textcaptchabreaker.appspot.com)
135 points by Xk 16y ago|54 comments
177.
by Xk 16y ago
It seems to me that this wouldn't work. There are not so many different types of phrasings, so it would be fairly simple to write a parser generator which would then pass to a very basic interpreter to solve them. For example, to solve the
178.
by Xk 16y ago
About ten years ago, I went to my father's work one Saturday afternoon. He worked at [big software company]. Throughout the entire building there were doors that were locked, and to open them, you'd put your badge next to the scanner and th
179.
by Xk 16y ago
I would probably bet most people approach JS like that. Which is probably related to the fact that there is so much bad javascript. People who don't really learn the language and just assume that they know [insert-statically-typed-language-
180.
by Xk 16y ago
http://www.schneier.com/

More ›