Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordle

rsk0315.github.io

Post reply on HN
Print view View original

211–220 of 263 posts

Re: Passwordle

#211

Post by mlyle »

selestify wrote: post #210
mlyle wrote: post #206

Earlier quoted context omitted.

> How would the oracle technique help at all? If they give you the hash upfront (or this oracle), you can test passwords offline without using up a limited number of guesses. It may be very computationally expensive to brute force the space, but the information is there . If they don't, you get 10 guesses, and you have effectively no chance of guessing the password.

Ah, I see what you mean. Yes, if you don't even have the entire hash, you're kind of out of luck. > It may be very computationally expensive to brute force the space, but the information is there. If the password is long enough, it will take longer than the heat death of the universe to brute force the space. So in practice, brute forcing secure passwords might as well be impossible.

> Yes, if you don't even have the entire hash, you're kind of out of luck.

Well, no-- I'm saying that if you have 9 guesses, you can get enough of the hash that you can eliminate all of the passwords but 1.

> If the password is long enough, it will take longer than the heat death of the universe to brute force the space. So in practice, brute forcing secure passwords might as well be impossible.

Here, the password has 88-90 bits of entropy. Out of reach to brute force, but just a few characters shorter and it wouldn't be. And, of course, if there's weaknesses in the hash function ever found, it may be able to elide some or all of this search process.

Re: Passwordle

#212

Post by ehsankia »

acchow wrote: post #156
mlyle wrote: post #107

Earlier quoted context omitted.

Is it? 6 guesses and I have 14 hex digits (56 bits) of the hash, along with knowing the population counts for all the numbers. This is enough to run a password cracker and determine the plaintext if it's a readily guessed password. Sure, it breaks conventional use of rainbow tables, etc, but... edit: Eh, 14 characters. OK, that's pretty resistant to anything other than debugging.

This isn’t how Sha works

Sure it is, dictionary attacks are extremely efficient, if the password is made out of dictionary words.

Re: Passwordle

#213

Post by ehsankia »

oceliker wrote: post #50
jpeter wrote: post #30

Earlier quoted context omitted.

Or use a new password every day like worle. So you have a community effort to guess it

That sounds like Bitcoin with extra steps Jokes aside, that would actually be fun if the password is actually reasonably guess-able, I would definitely give it a try if that existed

Oh no, now someone will make wordlecoin, where you have to work with others sharing hints to mine each block.

Re: Passwordle

#214

Post by eyelidlessness »

Aeolun wrote: post #170
residualmind wrote: post #124

Earlier quoted context omitted.

Yeah because the algo is known, it is SHA256. The thing is you don't know the length of the password. It could be more than the number of hydrogen atoms in the universe, or 12. You still have to brute force or look up one possible solution (or collision thereof). The whole thing just shows that a hash makes ZERO applicable inferable assertions about the message (password). Thats the definition of evenly distributed h…

> It could be more than the number of hydrogen atoms in the universe Not very likely, since the OP wouldn’t be able to hash it. Or he’s secretly demonstrating something much more awesome than Passwordle.

Why not? You don’t need enough resources, just lazy seq and time!

Re: Passwordle

#215

Post by Auracle »

koolba wrote: post #40
boothby wrote: post #37

Got it in one "guess." Apparently どうぞ means "here you are." Makes me think the brick was deliberately left in the door for folks who look for such things.

My first guess was "friend", a la the Doors of Durin. http://tolkiengateway.net/wiki/Doors_of_Durin

I tried hunter2

Re: Passwordle

#216

Post by antirez »

MattPalmer1086 wrote: post #162
antirez wrote: post #110

Earlier quoted context omitted.

You can easily guess the right sha256 just using random strings and overlapping correct characters and then you can run a dictionary attack on it, or a brute force one if it's not too long.

You get a SHA256 hash of each guess. The hints you get on each guess are useless to help you with the next guess.

Nope. Try yourself with a, b, c, d, e, f, g as guesses. You will see that green letters that are coincident will be the same. So to reconstruct the original SHA256 of the password is easy. The problem then turns like every other hash -> password reconstruction: hard if the original secret is hard to guess via dictionary/brute-force, otherwise easy.

Re: Passwordle

#220

Post by Normal_gaussian »

geraldwhen wrote: post #128
therein wrote: post #100

Earlier quoted context omitted.

int 3 of Javascript. I use it all the time because webpacked assets make it hard to find the line of code I am looking for.

If you build source maps this isn’t a problem.

And if you're using nodejs woth source maps, but still getting horrid stacks: "--enable-source-maps"

> NODE_OPTIONS="$NODE_OPTIONS --enable-source-maps"

Post reply on HN