Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spotting base64 encoded JSON, certificates, and private keys

ergaster.org

Post reply on HN
Print view View original

101–110 of 135 posts

Re: Spotting base64 encoded JSON, certificates, and private keys

#101

Post by esseph »

cestith wrote: post #24
Muromec wrote: post #21

After staring one time too much at base64-encoded or hex-encoded asn1 I started to believe that scene in the Matrix where operator was looking at raw stream from Matrix at his terminal and was seeing things in it.

Years ago I was part of a group of people I knew who could read and edit large parts of sendmail.cf by hand without using m4. Other people who had to deal with mail servers at the time certainly treated it like a superpower.

I wasn't one of those people, but I knew those people. The deepest I got was blindly doing fairly complex BIND DNS configs.

Re: Spotting base64 encoded JSON, certificates, and private keys

#102

Post by creatonez »

tharkun__ wrote: post #92
appreciatorBus wrote: post #74

Earlier quoted context omitted.

That’s really a leap about the writer’s interest. They could just as easily have felt the underlying reason was so obvious it wasn’t worth mentioning. I know how base64 encoding works but had never noticed the pattern the author pointed out. As soon as read it, I ubderstood why. It didn’t occur to me that the author should have explained it at a deeper level.

Is it? In the first paragraph the author clearly shows his ignorance of base64. When told that it "looks like base64 encoded JSON" he was incredulous but gave it a go, and it worked!! Even if you don't notice the ey specifically the string itself just screams base64 encoding, regardless of what's actually inside.

They were probably expecting base64 encoded binary data. Base64-encoded-binary-inside-Base64-encoded-JSON-inside-JSON is a really strange construction if you haven't encountered it before, because of how much space it's wasting playing a game of Russian nesting dolls.

Re: Spotting base64 encoded JSON, certificates, and private keys

#103

Post by dhosek »

anitil wrote: post #100
schoen wrote: post #78

Earlier quoted context omitted.

For anyone here who's never pondered it ("today's lucky 10,000"?), there's a lot of intentional structure in the organization of ASCII that comes through readily in binary or hex. https://altcodeunicode.com/ascii-american-standard-code-for-... The first nibble (hex digit) shows your position within the chart, approximately like 2 = punctuation, 3 = digits, 4 = uppercase letters, 6 = lowercase letters. (Yes, there's m…

> the character you'd get on a traditional U.S. keyboard layout I use a different layout so I'd never realised there was method to the madness! I get the following $ echo -n ' !@#$%^&*(' | xxd -p 2021402324255e262a28

It’s more the old TTY layout which differs somewhat from the modified typewriter layout that’s become standard for computer keyboards. The old Apple ][ keyboard had 1–9 corresponding to the next row in ASCII, shift-0 was @, I think other characters were ±16 based on shift. Early ASCII implementations were often slightly inconsistent but codings were often based on keyboard layouts.

Re: Spotting base64 encoded JSON, certificates, and private keys

#104

Post by schoen »

anitil wrote: post #100
schoen wrote: post #78

Earlier quoted context omitted.

For anyone here who's never pondered it ("today's lucky 10,000"?), there's a lot of intentional structure in the organization of ASCII that comes through readily in binary or hex. https://altcodeunicode.com/ascii-american-standard-code-for-... The first nibble (hex digit) shows your position within the chart, approximately like 2 = punctuation, 3 = digits, 4 = uppercase letters, 6 = lowercase letters. (Yes, there's m…

> the character you'd get on a traditional U.S. keyboard layout I use a different layout so I'd never realised there was method to the madness! I get the following $ echo -n ' !@#$%^&*(' | xxd -p 2021402324255e262a28

The @ for shift-2 replaced the earlier " which you would see on many 1980s-era PCs.

I forget the story about what changed for shift-6 through shift-9.

When I say "traditional U.S. keyboard layout" I mean to contrast this with the modern one, which is the same as what you and I have.

Re: Spotting base64 encoded JSON, certificates, and private keys

#106

Post by 0xml »

xg15 wrote: post #52
dlt713705 wrote: post #34

Earlier quoted context omitted.

What’s wrong with this? The purpose of Base64 is to encode data—especially binary data—into a limited set of ASCII characters to allow transmission over text-based protocols. It is not a cryptographic library nor an obfuscation tool. Avoid encoding sensitive data using Base64 or include sensitive data in your JWT payload unless it is encrypted first.

I think it's more the waste of space in it all. Encoding data in base64 increases the length by 33%. So base64-encoding twice will blow it up by 33% of the original data and then again 33% of the encoded data, making 69% in total. And that's before adding JSON to the mix... And before "space is cheap": JWT is used in contexts where space is generally not cheap, such as in HTTP headers.

Not exactly - encoding it twice increases by 4/3 * 4/3 - 1 = 7/9, which is about 77.78% more than the original.

Re: Spotting base64 encoded JSON, certificates, and private keys

#107

Post by throwaway4496 »

netsharc wrote: post #45

Good knowledge, now explain why it's like that. {" is ASCII 01111011, 00100010 Base64 takes 3 bytes x 8 bits = 24 bits, groups that 24 bit-sequence into four parts of 6 bits each, and then converts each to a number between 0-63. If there aren't enough bits (we only have 2 bytes = 16 bits, we need 18 bits), pad them with 0. Of course in reality the last 2 bits would be taken from the 3rd character of the JSON string,…

CS post covid is in the worst state it has ever been, vibe coding and AI has enabled a category of grifters beyond the wet dreams of blockchain hacks.

Re: Spotting base64 encoded JSON, certificates, and private keys

#109

Post by feliixh »

nneonneo wrote: post #96

Useful ones to know: - `R0lGOD` - GIF files - `iVBOR` - PNG files - `/9j/` - JPG files - `eyJ` - JSON - `PD94` - XML - `MII` - ASN.1 file, such as a certificate or private key These are nice to know since they show up pretty frequently (images in data: URLs, JSON/XML/ASN.1 in various protocols).

Very useful!

Re: Spotting base64 encoded JSON, certificates, and private keys

#110

Post by fc417fc802 »

creatonez wrote: post #102
tharkun__ wrote: post #92

Earlier quoted context omitted.

Is it? In the first paragraph the author clearly shows his ignorance of base64. When told that it "looks like base64 encoded JSON" he was incredulous but gave it a go, and it worked!! Even if you don't notice the ey specifically the string itself just screams base64 encoding, regardless of what's actually inside.

They were probably expecting base64 encoded binary data. Base64-encoded-binary-inside-Base64-encoded-JSON-inside-JSON is a really strange construction if you haven't encountered it before, because of how much space it's wasting playing a game of Russian nesting dolls.

Just add a layer of compression periodically to reclaim the wasted space and it will all work out.
Post reply on HN