Seems kinda impossible to do, lel
Passwordle
141–150 of 263 posts
Re: Passwordle
#142passWORDLE 1/1064 0 ⬜0 https://rsk0315.github.io/playground/passwordle.html on Chrome, open Dev Tools and type `res` to get the password :)
Yes, but the point is to show that each password produces a sha256 not correlated to the sha256 of other passwords. That people actually tried to guess this way shows that not everyone is aware of the sha256's purpose.
Re: Passwordle
#143Earlier quoted context omitted.
Yeah because the algo is known, it is SHA256. The thing is you don't know the length of the password. It could be more than the number of hydrogen atoms in the universe, or 12. You still have to brute force or look up one possible solution (or collision thereof). The whole thing just shows that a hash makes ZERO applicable inferable assertions about the message (password). Thats the definition of evenly distributed h…
I mean, anything past 256 bits is going to have a collision, so that doesn't matter, but you're right that the entire point of a hash is that even if you know the hash, it's very very hard to find what the plaintext is.
There are a number of reversible hash algos. The point of hash is that the small changes in the input produce big changes in the output so even a 1-bit change to the input produces a completely different output. Some hash algos having trap door functionality is really more of a bonus.
Re: Passwordle
#144Earlier quoted context omitted.
How does that help you when any of your inputs' digest is not related to any other's, not even knowing the target length of the original message? what am i missing?
The correct password is impossible to calculate from the given data, but it seems like it should be possible to check whether a password matches the data.
i don't think anyone has created a hash collision in SHA-256 yet (meaning, given a hash, create an input that generates the hash)
Re: Passwordle
#145Earlier quoted context omitted.
My first guess was "friend", a la the Doors of Durin. http://tolkiengateway.net/wiki/Doors_of_Durin
“The Four Most-Used Passwords Are Love, Sex, Secret, and God”
You hacker... https://www.youtube.com/watch?v=0Jx8Eay5fWQ
Re: Passwordle
#146Well, that’s not "dolphins".
Re: Passwordle
#147Earlier quoted context omitted.
Yeah because the algo is known, it is SHA256. The thing is you don't know the length of the password. It could be more than the number of hydrogen atoms in the universe, or 12. You still have to brute force or look up one possible solution (or collision thereof). The whole thing just shows that a hash makes ZERO applicable inferable assertions about the message (password). Thats the definition of evenly distributed h…
> The thing is you don't know the length of the password. It could be more than the number of hydrogen atoms in the universe, or 12. I'll take 12 then.
Well we know it has to fit in a string data type. And there’s only soooo much ram available to a JavaScript variable.
Re: Passwordle
#148Earlier quoted context omitted.
According to the best current knowledge of humanity, it provides no information whatsoever. However, proving that is difficult. It is possible that there exists an algorithm that could narrow in on the answer from hashes. Such an algorithm could run quickly, but it could also potentially take quite significant computation. We don't know what the true, optimal answer to this question is.
> According to the best current knowledge of humanity, it provides no information whatsoever. ??? My first guess has two green letters, or 8 bits of the hash are known. This excludes 255/256 of possible passwords-- so if there's a dictionary, it's way cut down. I also know for the other 30 digits a value that they are not -- this is about .1 bits apiece, for 3 more bits. And I get a few more bits from knowing the pop…
This is one of those places where it's easy to conflate computer bits with information theory bits. You may have eight computer bits, but in order for you to have eight bits of information, you must have your search space cut down by a factor of 256, not just the abstract concept of a search space cut down.
Can you enumerate the remaining 1/256th of the search space? Not with anything other than a brute force search, minus the one password you tried. The exact same brute force search that you would have needed to solve the problem in the first place. Your one password attempt has yielded one password's worth of knowledge. You, a human, don't have eight bits of information. You have almost nothing.
In principle, such a guess does eliminate 8 bits of information, but we have no way of manifesting that. In principle if we had a full list of the shortest passwords that led to the given hash, we could strike off the non-matching entries, but no human can do that. In principle an easier algorithm than the brute-force search exists, but we have no idea what it is, and we don't know what it would look like, whether it would be an incremental improvement over brute force or if there's hypothetically an algorithm that could do it on your cell phone in a couple of seconds or what.
Hashing and cryptography in general hide in this space between the theoretical information leakage and the practical inability to do anything with it. You have 8 theoretical bits and just shy of 0 real, practical bits.
Re: Passwordle
#149This is a masterpiece.
Re: Passwordle
#150Earlier quoted context omitted.
To me it seems like the password is 14 bytes, because they're 14 characters (112 bits). How do you get 90 bits? It also uses 96 possible characters for each digit. Just storing the 96^14 different passwords without even adding their corresponding SHA hashes would require 5646 yottabytes. Which is more than 4 orders of magnitude larger than all the world's digital storage capacity combined together.
As you say, each of the characters is not a full 8 bits (namely a character out of an alphabet of 256), but chosen from a smaller alphabet of 96 characters, and log(96)/log(2) = log_2(96) ≈ 6.58, so 6.58 * 14 = 92 bits. Then I deducted a bit or two ad-hoc for the way they're drawn, with letters overrepresented. This could be computed more precisely. But it's not more than 93 bits, and not less than 83 bits, I'd say.
Thank you so, so much for explaining this.