Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Every V4 UUID

everyuuid.com

Post reply on HN
Print view View original

231–240 of 381 posts

Re: Every V4 UUID

#231

Post by jiggawatts »

quietbritishjim wrote: post #179
jiggawatts wrote: post #149

Earlier quoted context omitted.

That provides very valuable information: DO NOT TRUST this machine to be secure! Similarly, any web site or app that can’t correctly handle a space character at the end of the password should never be trusted with anything of consequence.

Are you really worried that a card machine is going to leak your PIN? That doesn't seem to be a common attack vector compared to a third-party skimmer being attached or someone just mugging you and demanding your PIN under threat of physical violence. To answer the actual question: I don't know because I left my PIN at 4 digits, despite knowing I could use more, precisely because I didn't think it would really make m…

I'm not worried specifically about the PIN leaking.

The concern is that a 4-digit max PIN length is certainly implemented by someone who couldn't be bothered to read the spec for secure credit card transaction handling.

It's the equivalent of the "No brown M&Ms" clause or "Canary in the coal mine" test.

Nobody actually cares about the M&M color or some dumb bird.

Re: Every V4 UUID

#232

Post by dhosek »

lxgr wrote: post #121
tobyjsullivan wrote: post #21

The fact that the search works impressed me more than anything. Of course, like every great magic trick, it seems so simple once it is explained. For the curious, here's the linked blog post describing how the project works: https://eieio.games/blog/writing-down-every-uuid/ Edit to add: I'd only tried searching for an exact UUID when I wrote this comment. I didn't realize it supports full text search! Now I'm even mo…

A great example of Teller's observation that "sometimes magic is just someone spending more time on something than anyone else might reasonably expect."

My favorite of these was a trick where someone picked a card out of a deck and then Teller revealed a large version of that same card in an unexpected area in the vicinity, It turns out that what he had done was hide a complete set of large cards in the area before the trick and memorized the location of every one of them so, e.g., the king of hearts would be at the top of a palm tree, the three of spades under a drink tray, etc.

Re: Every V4 UUID

#233

Post by [deleted] »

nomilk wrote: post #220
croes wrote: post #17

Seems like some hacker leaked all UUIDs. Check if your UUIDs are part of the leak.

I think this is a joke, but I think it is a problem if someone finds any sensitive uuid here, because the list on this website is a tiny subset of all possible uuids, so it provides a useful rainbow table for anyone attempting brute force attacks. I.e. generating and using random uuids would have an astronomically small success rate, whereas trying the ones on this site may not (depending on where they came from, whi…

[deleted]

Re: Every V4 UUID

#234

Post by lxgr »

dhosek wrote: post #232
lxgr wrote: post #121

Earlier quoted context omitted.

A great example of Teller's observation that "sometimes magic is just someone spending more time on something than anyone else might reasonably expect."

My favorite of these was a trick where someone picked a card out of a deck and then Teller revealed a large version of that same card in an unexpected area in the vicinity, It turns out that what he had done was hide a complete set of large cards in the area before the trick and memorized the location of every one of them so, e.g., the king of hearts would be at the top of a palm tree, the three of spades under a dri…

The best part is that that kind of trick usually becomes more, rather than less, impressive when its inner working is revealed. I recently got to see them perform live, and my favorite trick by far was one of that kind.

Re: Every V4 UUID

#235

Post by maronato »

nomilk wrote: post #220
croes wrote: post #17

Seems like some hacker leaked all UUIDs. Check if your UUIDs are part of the leak.

I think this is a joke, but I think it is a problem if someone finds any sensitive uuid here, because the list on this website is a tiny subset of all possible uuids, so it provides a useful rainbow table for anyone attempting brute force attacks. I.e. generating and using random uuids would have an astronomically small success rate, whereas trying the ones on this site may not (depending on where they came from, whi…

All possible UUIDs are in this page, it’s not a tiny subset.

They are generated by your device on the fly as you move through the list so you can’t really use it as a rainbow table any more than manually creating the table yourself.

Re: Every V4 UUID

#236

Post by lxgr »

extraduder_ire wrote: post #99
quietbritishjim wrote: post #92

Earlier quoted context omitted.

PINs can be up to 6 digits (at least here in the UK, but I doubt it's country specific), even though the ones they give you by default are only ever 4. So that's only a leak of 1% of them.

Does that not cause problems on some card machines? I've come across a few that definitely don't let you put in more than four digits.

It most certainly does.

Re: Every V4 UUID

#237

Post by lxgr »

jiggawatts wrote: post #149
extraduder_ire wrote: post #99

Earlier quoted context omitted.

Does that not cause problems on some card machines? I've come across a few that definitely don't let you put in more than four digits.

That provides very valuable information: DO NOT TRUST this machine to be secure! Similarly, any web site or app that can’t correctly handle a space character at the end of the password should never be trusted with anything of consequence.

Why? PINs are limited to 4 digits in many markets, so it's not exactly extreme for a developer to not consider the (to them) edge case of 6 digit PINs on foreign cards.

Conversely, it seems very possible to support 6 digit PINs and yet still make a ton of horrible implementation mistakes, security and otherwise.

Re: Every V4 UUID

#238

Post by saagarjha »

ljm wrote: post #196
Freedom2 wrote: post #165

Earlier quoted context omitted.

Agreed. Everyone love puzzles that are worthy of an entire section in a blogpost for their interview questions, rather than stuff actually relevant to the job.

So I just brute forced every UUID in existence on my RTX GPU and loaded the dataset into a HA opensearch cluster on AWS. It took about 5 years of calling ‘uuid.Random()’ to effectively cover about 64% of the keyspace which is good enough. To facilitate full-text search I created a langchain application in python, hosted on kubernetes, that takes your search query and generates synonymous UUIDs via GPT o1-preview befo…

Did future aliens send you their quantum GPUs or what?

Re: Every V4 UUID

#239

Post by js2 »

lxgr wrote: post #234
dhosek wrote: post #232

Earlier quoted context omitted.

My favorite of these was a trick where someone picked a card out of a deck and then Teller revealed a large version of that same card in an unexpected area in the vicinity, It turns out that what he had done was hide a complete set of large cards in the area before the trick and memorized the location of every one of them so, e.g., the king of hearts would be at the top of a palm tree, the three of spades under a dri…

The best part is that that kind of trick usually becomes more, rather than less, impressive when its inner working is revealed. I recently got to see them perform live, and my favorite trick by far was one of that kind.

Penn only agreed to the "Red Ball" trick after Teller hit on the idea to tell the audience how it works at the start.

https://lasvegasweekly.com/news/2008/nov/20/man-ball-hoop-be...

https://www.thisamericanlife.org/619/transcript

https://www.youtube.com/watch?v=dhnATlPdG6A

Here they are showing how they do ball & cups by using clear cups and it's no less amazing:

https://www.youtube.com/watch?v=8osRaFTtgHo

Re: Every V4 UUID

#240

Post by lxgr »

jiggawatts wrote: post #231
quietbritishjim wrote: post #179

Earlier quoted context omitted.

Are you really worried that a card machine is going to leak your PIN? That doesn't seem to be a common attack vector compared to a third-party skimmer being attached or someone just mugging you and demanding your PIN under threat of physical violence. To answer the actual question: I don't know because I left my PIN at 4 digits, despite knowing I could use more, precisely because I didn't think it would really make m…

I'm not worried specifically about the PIN leaking. The concern is that a 4-digit max PIN length is certainly implemented by someone who couldn't be bothered to read the spec for secure credit card transaction handling. It's the equivalent of the "No brown M&Ms" clause or "Canary in the coal mine" test. Nobody actually cares about the M&M color or some dumb bird.

"Must support 6-digit PINs" is not part of "the spec for secure credit card transaction handling" – which is also not a (or at least one) thing: There are dozens of card networks, and many of them have tons of regional variations.

In some markets, issuers only allow 4 digit PINs, and customers don't expect to have to press an "enter" key when they're done entering their 4 digit PIN – so the reasonable implementation is to allow only 4 digit PINs, or you'll be left with people staring at the ATM/POS terminal, waiting for something to happen.

Post reply on HN