Xkcd: Encryptic
xkcd.com
Xkcd: Encryptic
1–10 of 64 posts
Re: Xkcd: Encryptic
#2Image tooltip text made me laugh:
>>It was bound to happen eventually. This data theft will enable almost limitless [xkcd.com/792]-style password reuse attacks in the coming weeks. There's only one group that comes out of this looking smart: Everyone who pirated Photoshop.[xkcd.com/792]: http://xkcd.com/792/
Re: Xkcd: Encryptic
#3Anyone care to explain the DES misuse to laypeople? And why do some passwords have a salt(?) and some don't?
Re: Xkcd: Encryptic
#4Anyone care to explain the DES misuse to laypeople? And why do some passwords have a salt(?) and some don't?
That's not salt.
"Since DES only encrypts in blocks of 64 bits (8 bytes) then encrypting and keeping the length of blocks means that you actually get a very good idea of the length of the password - that is, anything with only one block is a password length between 1 and 8 characters, with two blocks between 9 and 16 characters etc. In addition a password of "1234567812345678" would encrypt into two identical blocks."
Re: Xkcd: Encryptic
#5Anyone care to explain the DES misuse to laypeople? And why do some passwords have a salt(?) and some don't?
The passwords don't have a salt: that extra block that some of them have is the second block of the password (each block of 8 bytes is encrypted separately).
Re: Xkcd: Encryptic
#6Image tooltip text made me laugh: >>It was bound to happen eventually. This data theft will enable almost limitless [xkcd.com/792]-style password reuse attacks in the coming weeks. There's only one group that comes out of this looking smart: Everyone who pirated Photoshop. [xkcd.com/792]: http://xkcd.com/792/
He missed a group of people: any designer who did not entrust their entire professional workflow to a single, for-profit company whose best interests are in moving your workflow in ways that benefit the company over the user. Being dependent on something like Photoshop for your only income is a terrible position to be in, yet it is how I'd describe most designers today.
Re: Xkcd: Encryptic
#7Anyone care to explain the DES misuse to laypeople? And why do some passwords have a salt(?) and some don't?
As I understand it, Adobe used ECB mode, which means the blocks are encrypted independently. You can look at the encrypted blocks and see that two different passwords share character sequences. This is I assume what Randall is referring to with the 'crossword' bit - as well as having clues in the hints, solving one password may give you part of another. The suffix may also contain only one or two characters (plus padding) which makes it more plausible to mount a brute force attack.
ECB mode is just terrible. As well as these suffix problems, I've seen another example where a company used it to encrypt key-value pair cookies. Of course the keys are always the same...so prefixes were guessable too. And wikipedia has a fantastic example of why its stupid for images:
http://en.wikipedia.org/wiki/ECB_mode#Electronic_codebook_.2...
Re: Xkcd: Encryptic
#8Image tooltip text made me laugh: >>It was bound to happen eventually. This data theft will enable almost limitless [xkcd.com/792]-style password reuse attacks in the coming weeks. There's only one group that comes out of this looking smart: Everyone who pirated Photoshop. [xkcd.com/792]: http://xkcd.com/792/
He missed a group of people: any designer who did not entrust their entire professional workflow to a single, for-profit company whose best interests are in moving your workflow in ways that benefit the company over the user. Being dependent on something like Photoshop for your only income is a terrible position to be in, yet it is how I'd describe most designers today.
That situation cannot be (or should not be) avoided if a product is significantly better that any other competitor on the market. You can choose between
- depending on the for-profit company
- having disadvantage on the marketplace because of inferior tools
I think the former is often preferable.
Re: Xkcd: Encryptic
#9explainxkcd hasn't worked out the passwords yet.
Re: Xkcd: Encryptic
#10Is there a website out there that will tell you how many times your password has been used based on this database of the 153millions accounts?