Live data from Hacker News

See if you can break my hiding algorithm –> take the private key

redactsure.com

11–20 of 20 posts

Re: See if you can break my hiding algorithm –> take the private key

#12

Earlier quoted context omitted.

What did you try to do? If you had the full key it should be relatively simple. Maybe I should post some instructions on claiming the key?

Launch Electrum, create a new wallet, "Import Bitcoin addresses or private keys", paste in the recovered key. If you just paste the raw key, Electrum uses a legacy format, and none of the transactions show up for that private key. Adding the "p2wpkh:" prefix to the key makes the transactions show up, but I realized that well after someone else claimed it. I don't know if this is an Electrum thing, if this is consider…

back up if you want another chance

Re: See if you can break my hiding algorithm –> take the private key

#13

Earlier quoted context omitted.

Launch Electrum, create a new wallet, "Import Bitcoin addresses or private keys", paste in the recovered key. If you just paste the raw key, Electrum uses a legacy format, and none of the transactions show up for that private key. Adding the "p2wpkh:" prefix to the key makes the transactions show up, but I realized that well after someone else claimed it. I don't know if this is an Electrum thing, if this is consider…

back up if you want another chance

Got it :)

Pasted the private key into the email address field on the Wufoo signup page, and the validator helpfully told me my "email" was invalid, with the whole key included.

Re: See if you can break my hiding algorithm –> take the private key

#14

Earlier quoted context omitted.

What did you try to do? If you had the full key it should be relatively simple. Maybe I should post some instructions on claiming the key?

Launch Electrum, create a new wallet, "Import Bitcoin addresses or private keys", paste in the recovered key. If you just paste the raw key, Electrum uses a legacy format, and none of the transactions show up for that private key. Adding the "p2wpkh:" prefix to the key makes the transactions show up, but I realized that well after someone else claimed it. I don't know if this is an Electrum thing, if this is consider…

that was brutal! I knew you were holding out something. Oh man this is a brutal bug as well. That's an OS popup! That's gonna take me some time.

Actually even worse it's neither an OS level or dom level item custom chrome rendering layer.

Re: See if you can break my hiding algorithm –> take the private key

#15

Earlier quoted context omitted.

Launch Electrum, create a new wallet, "Import Bitcoin addresses or private keys", paste in the recovered key. If you just paste the raw key, Electrum uses a legacy format, and none of the transactions show up for that private key. Adding the "p2wpkh:" prefix to the key makes the transactions show up, but I realized that well after someone else claimed it. I don't know if this is an Electrum thing, if this is consider…

that was brutal! I knew you were holding out something. Oh man this is a brutal bug as well. That's an OS popup! That's gonna take me some time. Actually even worse it's neither an OS level or dom level item custom chrome rendering layer.

That explains why the validator error looked entirely different when I tried to reproduce it locally -- I was wondering about that.

And yeah, it's a CTF, gotta hold onto issues until the flag redemption is back up.

Re: See if you can break my hiding algorithm –> take the private key

#16

Earlier quoted context omitted.

that was brutal! I knew you were holding out something. Oh man this is a brutal bug as well. That's an OS popup! That's gonna take me some time. Actually even worse it's neither an OS level or dom level item custom chrome rendering layer.

That explains why the validator error looked entirely different when I tried to reproduce it locally -- I was wondering about that. And yeah, it's a CTF, gotta hold onto issues until the flag redemption is back up.

bet you couldn't do it again. It's back up. Patch is a bit hacky but should work plus I blocked the signup page.

Real patch is a chromium update (like a week of work) so imma avoid that until needed.

Re: See if you can break my hiding algorithm –> take the private key

#17

The key Nextgrid pasted is correct, I got the coins under email kiknubesti@necub.com. I got the key by pasting into the text input line in the HTML input types demo and adding spaces after the text. The box blocking the view moved to the left and uncovered some characters. I then selected these characters and while dragging left, the key was revealed one by one, which I then OCRd from the screencap. Though at some po…

Up...again

Re: See if you can break my hiding algorithm –> take the private key

#18

The key Nextgrid pasted is correct, I got the coins under email kiknubesti@necub.com. I got the key by pasting into the text input line in the HTML input types demo and adding spaces after the text. The box blocking the view moved to the left and uncovered some characters. I then selected these characters and while dragging left, the key was revealed one by one, which I then OCRd from the screencap. Though at some po…

Up...again

got it. went to the html form example, pasted into the text box and then tried uploading a file. "Access to local files ..." text on the top of the page moved the whole page down, exposing the key.

Re: See if you can break my hiding algorithm –> take the private key

#19

Earlier quoted context omitted.

Up...again

got it. went to the html form example, pasted into the text box and then tried uploading a file. "Access to local files ..." text on the top of the page moved the whole page down, exposing the key.

Ahhh, this is fun. My own security policy working against me! back to top of the leaderboard for you!

Re: See if you can break my hiding algorithm –> take the private key

#20

Earlier quoted context omitted.

got it. went to the html form example, pasted into the text box and then tried uploading a file. "Access to local files ..." text on the top of the page moved the whole page down, exposing the key.

Ahhh, this is fun. My own security policy working against me! back to top of the leaderboard for you!

sent you an email through the contact form :)
Post reply on HN