291–300 of 381 posts
I'd like to announce my new `npm` package called `get-uuid`. Behind the scenes, it loads `everyuuid.com`, picks a random row number, and returns that UUID.
Earlier quoted context omitted.
The most offensive sentence I could come up with leetspeak/hexspeak is this one: fe11a710-babe-4150-ace5-b19b1accd1cc (Yes it's a valid UUID) (I am so sorry)
Got the rest but what is ace5? Aces?
Earlier quoted context omitted.
FWIW I am super interested in this question but feel like I don't know how to derive a satisfying answer, maybe because the one of my goals here (add "enough" entropy) is a real fuzzy "I know it when I see it" sort of thing. But I'm gonna try to get a few more crypto-knowledgeable friends to chat with me about this and write up what I learn!
My first thought was to use linear transformations over Z_2 as a field, as that would create a natural interpretation of fixing certain bits as taking a linear subspace. Interestingly this leads to the property that XOR is preserved. I implemented this in a very quick and hacky way for 32 bits. I generated a random boolean matrix M invertible in Z_2. To turn an input number x into a corresponding number y in an N-bit…
The first problem is that, when your enciphering function is a matrix, f(0) = 0. This looks bad, but we can easily solve that problem by starting the webpage sequence at an index higher than 0.
I tried to work through a much smaller version of the problem* by hand, and it looks like this:
We have our enciphering matrix N:
[[1 1 1 1 1]
[1 0 0 1 1]
[1 1 1 0 0]
[0 1 1 1 0]
[1 0 1 0 0]]
[[1 1 1 0 0]
[0 0 1 0 1]
[1 1 1 0 1]
[1 1 0 1 0]
[0 1 1 1 0]]
y_1 = x_1 + x_2 + 1
y_2 = 1
y_3 = x_1 + x_2 + 1
y_4 = x_1 + x_2 + 1
y_5 = x_2
Assuming we want the least possible value for y, this means we will pick y_1 = 0 and y_5 = 0, which then tells us that we want index [0 1 0 0 0], and we can jump to there. If we wanted the least possible value for y above a threshold (such as the current viewport), we'd pick y_n values accordingly.
Instinct tells me that libraries should exist for quickly solving systems of linear equations like this.
(For full full-text search, we'd need to do this several times, also finding solutions for the enciphered values 110xx, and x110x. This multiplies the work we need to do and the storage we need to use by an amount that is linear in the difference in length between the search string and the full UUID, which is still a lot better than trial-and-error.)
* I ended up doing it in 5 bits because every random 4x4 matrix I generated was noninvertible.
Earlier quoted context omitted.
I'm not worried specifically about the PIN leaking. The concern is that a 4-digit max PIN length is certainly implemented by someone who couldn't be bothered to read the spec for secure credit card transaction handling. It's the equivalent of the "No brown M&Ms" clause or "Canary in the coal mine" test. Nobody actually cares about the M&M color or some dumb bird.
"Must support 6-digit PINs" is not part of "the spec for secure credit card transaction handling" – which is also not a (or at least one) thing: There are dozens of card networks, and many of them have tons of regional variations. In some markets, issuers only allow 4 digit PINs, and customers don't expect to have to press an "enter" key when they're done entering their 4 digit PIN – so the reasonable implementation…
Making an ATM that can accept cards from multiple issuers (which is the norm these days) and allowing only 4 digits is the same category of error as requiring that the first character of someone's last name start with a capital letter, or to block symbol characters in names.
Earlier quoted context omitted.
> If we didn’t care about generating valid UUID v4s, we could just generate 2^128 numbers, scramble them, convert the resulting bits into a hex string, and intersperse some dashes. You can do that anyway. You'd only need the twiddling if you wanted to limit the amount of numbers you generate to 2^122. Since you're willing to generate 128 bits: // get encrypted value uint128 bits = encipher(seed); // clear zero bits b…
I considered this, but I'd just be so unsatisfied if I finished scrolling through all 2^128 rows and realized I'd seen some duplicates!
With a linear algebra library, you can guarantee that you've found the next, or the previous, match in sequence. I don't know what the state of the art is for fast linear algebra in javascript, though.
(The matrix approach also has the advantage that, when your full-text search problem has 2^115 solutions, you can compute the one you want, the next one after some index, without having to compute them all.)
Earlier quoted context omitted.
Does that not cause problems on some card machines? I've come across a few that definitely don't let you put in more than four digits.
That provides very valuable information: DO NOT TRUST this machine to be secure! Similarly, any web site or app that can’t correctly handle a space character at the end of the password should never be trusted with anything of consequence.
> Browsers do not want to render a window that is over a trillion trillion pixels high, so I needed to handle scrolling and rendering on my own What’s fun is what actually happens when you try to do these things. It’s disappointing, you can’t even get anywhere near one trillion pixels. The limits I found five years ago when working at Fastmail, after a customer using IE found their scrollbar broke when they had aroun…
The fact that the search works impressed me more than anything. Of course, like every great magic trick, it seems so simple once it is explained. For the curious, here's the linked blog post describing how the project works: https://eieio.games/blog/writing-down-every-uuid/ Edit to add: I'd only tried searching for an exact UUID when I wrote this comment. I didn't realize it supports full text search! Now I'm even mo…
reminds of me this daniel dennett quote
Real magic, in other words, refers to the magic that is not real, while the magic that is real, that can actually be done, is not real magic.