Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordle

rsk0315.github.io

Post reply on HN
Print view View original

101–110 of 263 posts

Re: Passwordle

#101

Post by Sohcahtoa82 »

hbn wrote: post #79
travisgriggs wrote: post #52

They cynical side of me notes what a great phish this could be. People are inclined to enter passwords they regularly use just to see the visualization of their favorite passwords. With a little logging -> send home, you'd be harvesting passwords left and right.

It's hosted on Github Pages which is just static file serving. And thanks to CORS restrictions I don't think you could phone home. Unless there's a workaround I'm not thinking of.

The CORS policy is set by the server receiving the request, not the page/server sending it.

Re: Passwordle

#102

Post by therein »

core-utility wrote: post #69
faeyanpiraat wrote: post #46

Earlier quoted context omitted.

Is any of the information (yellow/green for characters) presented getting you closer to the real answer in any meaningful way though?

Inherently with a (proper) hashing algorithm, the value and placement of characters in the hash means next-to-nothing in terms of the actual original text. For example: password = 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8 passwurd = 1966e583daff0fce5630d5de44f303f0e77f77940f02c7d648defadc31059c7b Notice they're very different results, even though the original text only has 1 character differenc…

The Avalanche effect for anyone interested in reading more.

https://en.wikipedia.org/wiki/Avalanche_effect

Re: Passwordle

#103

Post by therein »

aerovistae wrote: post #22
TYMorningCoffee wrote: post #8

Earlier quoted context omitted.

I did not know about the debugger statement until I read your comment: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... . Thank you.

Massively useful! I also recently learned you can right click a line of code in the chrome debugger to add a logpoint - i.e. "log the value of this expression when you reach this point in the code" - so I don't have to manually add console.log statements. Basically the reverse of discovering the debugger statement!

You can also right click a DOM element in the inspector and click `store as a global variable`. It will automatically do the following for you

temp1 = document.querySelector(SELECTOR_FOR_NODE_YOU_PICKED)

Re: Passwordle

#104

Post by tetha »

burke wrote: post #66

This would be kind of fun to write a solver for. You'd burn the first few guesses to get some positional constraints, then filter a rainbow table down to viable guesses. I'm not sure you'd be able to get a very good success rate in just 10 possible guesses though.

If you can casually write an algorithm to break a modern cryptographic hash in 10 guesses... I would like to know. Because then I have to decide if I want to be a very good friend of you, once you get rich, or if I want to stay as far away from you as possible once the state intelligence agencies come after you.

Re: Passwordle

#105

Post by runnerup »

FabHK wrote: post #88
burke wrote: post #66

This would be kind of fun to write a solver for. You'd burn the first few guesses to get some positional constraints, then filter a rainbow table down to viable guesses. I'm not sure you'd be able to get a very good success rate in just 10 possible guesses though.

It could work theoretically (the password contains around 90 bits, and from each row you can glean, dunno, some 64 bits of info (64 characters that can be yellow, gray or green, so 101 bits, but there are constraints on that - very unlikely that all characters are gray, for example)). In practice, I don't think it's computationally feasible. You can't keep all 2^90 = 10^27 possible solutions around in memory. Bitcoin…

To me it seems like the password is 14 bytes, because they're 14 characters (112 bits). How do you get 90 bits?

It also uses 96 possible characters for each digit. Just storing the 96^14 different passwords without even adding their corresponding SHA hashes would require 5646 yottabytes. Which is more than 4 orders of magnitude larger than all the world's digital storage capacity combined together.

Re: Passwordle

#106

Post by hbn »

jamespwilliams wrote: post #85
hbn wrote: post #79

Earlier quoted context omitted.

It's hosted on Github Pages which is just static file serving. And thanks to CORS restrictions I don't think you could phone home. Unless there's a workaround I'm not thinking of.

GitHub pages are served with Access-Control-Allow-Origin: *, so the SOP doesn’t apply. They also don’t set a CSP header, which opens up the opportunity to exfiltrate data by other means, e.g having the browser load an image on your.site/$password.jpg.

Ah right. Simple!

Re: Passwordle

#107

Post by mlyle »

moritonal wrote: post #7

There is like... four people I know I could send this to who'd laugh, it's so niche. Yet I also laughed out loud when I got how conventionally impossible it is.

Is it?

6 guesses and I have 14 hex digits (56 bits) of the hash, along with knowing the population counts for all the numbers. This is enough to run a password cracker and determine the plaintext if it's a readily guessed password.

Sure, it breaks conventional use of rainbow tables, etc, but...

edit: Eh, 14 characters. OK, that's pretty resistant to anything other than debugging.

Re: Passwordle

#108

Post by JAlexoid »

moritonal wrote: post #7

There is like... four people I know I could send this to who'd laugh, it's so niche. Yet I also laughed out loud when I got how conventionally impossible it is.

Oh wow! You have a lot of friends!... (unironic self deprecating voice)

Re: Passwordle

#109

Post by Kluny »

It's not hunter2, correcthorsebatterystaple, password123, swordfish, or my gmail password. Anyone got it?

Re: Passwordle

#110

Post by antirez »

moritonal wrote: post #7

There is like... four people I know I could send this to who'd laugh, it's so niche. Yet I also laughed out loud when I got how conventionally impossible it is.

You can easily guess the right sha256 just using random strings and overlapping correct characters and then you can run a dictionary attack on it, or a brute force one if it's not too long.
Post reply on HN