Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xkcd: Encryptic

xkcd.com

Post reply on HN
Print view View original

31–40 of 64 posts

Re: Xkcd: Encryptic

#31

Post by DanBC »

nodata wrote: post #25
raws wrote: post #17

Earlier quoted context omitted.

no need to download it if you just want to check yourself: http://adobe.cynic.al/ props to: https://news.ycombinator.com/item?id=6661774

"bill@microsoft.com was found. You need to change your passwords now."

example@example.com

nospam@nospam.com

nospam@here.com

Were all found.

I feel sorry for the people paying a lot of money to buy these short domain names, and finding huge amounts of spam being delivered to them because people have misused domain names that don't belong to them.

Re: Xkcd: Encryptic

#32

Post by kaivi »

Someone should assemble the leaked hashes and hints into a real, huge browser-based multiplayer crossword. Imagine how awesome would that be.

Re: Xkcd: Encryptic

#33

Post by rmc »

What's the status with figuring out the encryption key and breaking all those passwords? Surely there are known passwords. Is there any distributed brute force attempt that I can help with?

Re: Xkcd: Encryptic

#34

Post by stonemetal »

NateDad wrote: post #29

Yay for LastPass - my password at adobe is a long string of gobbedlygook that is unique to the site. I changed it just in case... which makes me think... Why the hell hasn't Adobe reset everyone's password yet? That would be the FIRST thing I did in that situation. At least prevent the world from being able to log into my own site with the leaked passwords.

I believe they are trying to make sure the system is secure first. No point in having everyone reset their password if the bad guys still have access to the password db.

Re: Xkcd: Encryptic

#35

Post by p4bl0 »

DanBC wrote: post #31
nodata wrote: post #25

Earlier quoted context omitted.

"bill@microsoft.com was found. You need to change your passwords now."

example@example.com nospam@nospam.com nospam@here.com Were all found. I feel sorry for the people paying a lot of money to buy these short domain names, and finding huge amounts of spam being delivered to them because people have misused domain names that don't belong to them.

Actually example.com is reserved for test usage and this kind of things. You are right for the two others thought.

Re: Xkcd: Encryptic

#36

Post by JulianMorrison »

sudhirj wrote: post #3

Anyone care to explain the DES misuse to laypeople? And why do some passwords have a salt(?) and some don't?

ECB mode encryption is like the kind of cereal box cyphers you probably played with as a kid. For any given key, a fixed block of data goes in, a fixed block of data comes out. It won't usually be the whole of the password, but maybe "password" comes out as "94a012e6de4f1f0e" always. And so if you can guess that, then you're halfway to guessing "password123" and "passwordQWERTY" and so on.

In general, using any mode of encryption (rather than hashing) on passwords is dumb. But this is dumber than usual.

Re: Xkcd: Encryptic

#37

Post by DanBC »

p4bl0 wrote: post #35
DanBC wrote: post #31

Earlier quoted context omitted.

example@example.com nospam@nospam.com nospam@here.com Were all found. I feel sorry for the people paying a lot of money to buy these short domain names, and finding huge amounts of spam being delivered to them because people have misused domain names that don't belong to them.

Actually example.com is reserved for test usage and this kind of things. You are right for the two others thought.

But using example on someone else's website to avoid using your own email address is not using it in documentation. .invalid would be a better choice.

I agree that I'm quibbling over probably unimportant details :-)

http://www.iana.org/domains/reserved

http://tools.ietf.org/html/rfc2606

Re: Xkcd: Encryptic

#38

Post by berberous »

tompaton wrote: post #23
bladedtoys wrote: post #18

Earlier quoted context omitted.

To make it searchable on your password, someone would have to go through the Adobe set and use the hints to manually figure out the clear text form. Off hand, it's hard to see how posting that on the web could be done responsibly. But until someone does, you could just Google "most common passwords" and if yours is in the set, you win!

no, you have known plain text, so you just have to encrypt your password using the same algorithm and then search the database for matching ciphertext, there's no need to find the clear text for any of the passwords.

you can't re-encrypt since we don't have the keys. but you can search for your e-mail, pull up the associated hash, and then search for the hash to see who else used that password, and list all of their password hints.

Re: Xkcd: Encryptic

#39

Post by sect »

bladedtoys wrote: post #18
raws wrote: post #10

Is there a website out there that will tell you how many times your password has been used based on this database of the 153millions accounts?

To make it searchable on your password, someone would have to go through the Adobe set and use the hints to manually figure out the clear text form. Off hand, it's hard to see how posting that on the web could be done responsibly. But until someone does, you could just Google "most common passwords" and if yours is in the set, you win!

A rainbow table would probably be more accurate than a password set that comes up on google.

Re: Xkcd: Encryptic

#40

Post by raws »

berberous wrote: post #38
tompaton wrote: post #23

Earlier quoted context omitted.

no, you have known plain text, so you just have to encrypt your password using the same algorithm and then search the database for matching ciphertext, there's no need to find the clear text for any of the passwords.

you can't re-encrypt since we don't have the keys. but you can search for your e-mail, pull up the associated hash, and then search for the hash to see who else used that password, and list all of their password hints.

That's what I had in mind... Anyone care to make a website for that?
Post reply on HN