Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordle

rsk0315.github.io

Post reply on HN
Print view View original

121–130 of 263 posts

Re: Passwordle

#121

Post by thewakalix »

residualmind wrote: post #117
mlyle wrote: post #107

Earlier quoted context omitted.

Is it? 6 guesses and I have 14 hex digits (56 bits) of the hash, along with knowing the population counts for all the numbers. This is enough to run a password cracker and determine the plaintext if it's a readily guessed password. Sure, it breaks conventional use of rainbow tables, etc, but... edit: Eh, 14 characters. OK, that's pretty resistant to anything other than debugging.

How does that help you when any of your inputs' digest is not related to any other's, not even knowing the target length of the original message? what am i missing?

The correct password is impossible to calculate from the given data, but it seems like it should be possible to check whether a password matches the data.

Re: Passwordle

#124

Post by residualmind »

thewakalix wrote: post #121
residualmind wrote: post #117

Earlier quoted context omitted.

How does that help you when any of your inputs' digest is not related to any other's, not even knowing the target length of the original message? what am i missing?

The correct password is impossible to calculate from the given data, but it seems like it should be possible to check whether a password matches the data.

Yeah because the algo is known, it is SHA256.

The thing is you don't know the length of the password. It could be more than the number of hydrogen atoms in the universe, or 12. You still have to brute force or look up one possible solution (or collision thereof).

The whole thing just shows that a hash makes ZERO applicable inferable assertions about the message (password).

Thats the definition of evenly distributed hashing functions: change anything in the message, including length, and there will be no identifiable relation between the hashes of one messsage and the next you try,

Re: Passwordle

#125

Post by jacquesm »

residualmind wrote: post #124
thewakalix wrote: post #121

Earlier quoted context omitted.

The correct password is impossible to calculate from the given data, but it seems like it should be possible to check whether a password matches the data.

Yeah because the algo is known, it is SHA256. The thing is you don't know the length of the password. It could be more than the number of hydrogen atoms in the universe, or 12. You still have to brute force or look up one possible solution (or collision thereof). The whole thing just shows that a hash makes ZERO applicable inferable assertions about the message (password). Thats the definition of evenly distributed h…

> The thing is you don't know the length of the password. It could be more than the number of hydrogen atoms in the universe, or 12.

I'll take 12 then.

Re: Passwordle

#126

Post by d--b »

Just checked the source, I am so sad that the answer is actually random. Couldn't read the comments in Japanese though

Re: Passwordle

#127

Post by thewakalix »

residualmind wrote: post #120
mlyle wrote: post #113

Earlier quoted context omitted.

> According to the best current knowledge of humanity, it provides no information whatsoever. ??? My first guess has two green letters, or 8 bits of the hash are known. This excludes 255/256 of possible passwords-- so if there's a dictionary, it's way cut down. I also know for the other 30 digits a value that they are not -- this is about .1 bits apiece, for 3 more bits. And I get a few more bits from knowing the pop…

Are you sure thats how evenly distributed hash algorithms work? change one letter of your string, or just make it longer or shorter - none of your green fields will stay.

Nothing about this algorithm relies on similar words producing similar hashes. If the word “foobar” has a 0 in the first digit of its hash, and you see a green 1 in the first digit in Passwordle, then you know that the answer can’t be foobar.

Re: Passwordle

#128

Post by geraldwhen »

therein wrote: post #100
umvi wrote: post #82

Earlier quoted context omitted.

TIL there's a "debugger" keyword[0] in JavaScript that auto-sets a breakpoint at that line. [0] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

int 3 of Javascript. I use it all the time because webpacked assets make it hard to find the line of code I am looking for.

If you build source maps this isn’t a problem.

Re: Passwordle

#129

Post by SamPatt »

brainfish wrote: post #65
moltenguardian wrote: post #58

Someone more capable than I should make the final form of this: No green or yellow feedback is provided, but only the timing information used to calculate it. If cryptographers are serious about side-channel attacks, why not show off the danger using no-information Wordle? (edit: Absurdle was taken)

An Absurdle exists[1], but instead of giving no hints it is adversarial, e.g. changing the secret word to dodge your guesses. [1] https://qntm.org/files/absurdle/absurdle.html

That's actually quite fun!

Re: Passwordle

#130

Post by LeoNatan25 »

moritonal wrote: post #7

There is like... four people I know I could send this to who'd laugh, it's so niche. Yet I also laughed out loud when I got how conventionally impossible it is.

I laughed. It’s excellent, and great fit for the crowd here.
Post reply on HN