{{comic
| number = 743
| date = May 21, 2010
| title = Infrastructures
| image = infrastructures.png
| titletext = The heartfelt tune it plays is CC licensed, and you can get it from my seed on JoinDiaspora.net whenever that project gets going.
}}

==Explanation==
[[Cueball]] has sent an essay to a fellow. While the essay itself was good, his fellow was worried because the essay was in a .doc format, the {{w|Proprietary Software|proprietary format}} that old versions of {{w|Microsoft Word}} used [compared to the newer .docx format (circa 2007)]. The fellow advises Cueball to use a format based on an open standard (one example being the ODF format (file extensions <code>.odt</code>, <code>.ods</code>, <code>.odp</code>, etc.) used in {{w|OpenOffice}} and {{w|LibreOffice}}, both {{w|free software}} ([http://www.gnu.org/licenses/gpl.html/ referring to freedom, not price])). However, Cueball, who does not appreciate the fellow's ideology, argued that the fellow is making petty fights about the details of software instead of simply bothering that the software works (which is, in essence, a primordial purpose of software). Given that open-source software tend to lack the familiarity, features, support and reach of their proprietary variants, not working with proprietary formats in extreme cases, Cueball has *some* justification for his stance.

The bearded fellow brings up that he is just concerned at the current proprietary software infrastructure that forces users to use software in a specific way, penalizing them for sharing the software or even looking at the source code in order to learn how the program works so nicely or even how to code nicely in the first place. Cueball makes a retort that his fellow has [http://www.gnu.org/philosophy/no-word-attachments.html/ an arrogance that crowds out his perspective] while claiming that he is {{w|Autism|autistic}}. (Autistic people do have a tendency to have intense fixations to things, even things that other people would find mundane or even odd. They also have trouble knowing the problems of the world outside of themselves, having them lack perspective of things at times. Even so, Cueball's remark suggests that he thinks that "autistic" is just another word for "retarded" which is another word for "stupid", a double-fallacy.)

Seven years later, Cueball runs to the fellow clamoring about Facebook's heavy policies about its complete control about the information its users submit. Since both, Microsoft and Facebook, have a lack of transparency about their services and take away a lot of control from the user, the fellow retorts with playing "the world's tiniest open-source violin." While "[http://tvtropes.org/pmwiki/pmwiki.php/Main/WorldsSmallestViolin playing the world's smallest violin]" is a sarcastic expression that denotes that the speaker will not give pity to the recipient, the title text reveals that the fellow does have ''actual'' violin software available for torrent.

The title text references the following services that are compatible with the "free software" ideology:
:[http://www.creativecommons.org Creative Commons licenses] use existing copyright law to permit someone to share a work (in this case, a song) anywhere if the sharer attributes credit to the creator of the work. There are also options for allowing modification, derivative works, and commercial usage.
:The "seed" to which the fellow mentioned is a reference to {{w|Torrenting}}, an infrastructure that allows users to host the files others download. Essentially, the user packs a( set of) file(s) in a torrent file then "seeds" the torrent file using a program made for torrenting (for example, {{w|uTorrent}}, the "seeder"'s computer essentially turning into a server. People who want to download the files would download the associated torrent file, use a torrenting program, and "leech" the file. After the file(s) inside the torrent file is downloaded, the "leechers" can "seed" the file so that more people can download the file in turn. Since the user is in control of the upload and download, torrenting is an option of choice for those in support of free software.
:[http://joindiaspora.com joindiaspora.com] (formerly joindiaspora.net) is the central host of {{w|Diaspora (social network)| Diaspora*}}, an open-source alternative to Facebook which puts the user in control of how his information is used. (There is a bit of irony here, since Cueball went to the fellow due to his own problems with how Facebook handled his information.)

==Transcript==
:[Cueball approaches a bearded fellow.]
:Cueball: Did you get my essay?
:Bearded Fellow: Yeah, it was good! But it was a .doc; You should really use a more open--
:Cueball: Give it a ''rest'' already. Maybe we just want to live our lives and use software that ''works'', not get wrapped up in your stupid nerd turf wars.

:Bearded Fellow: I just want people to care about the infrastructures we're building and who--
:Cueball: No, you just want to feel smugly superior. You have no sense of perspective and are probably autistic.

:2010:
:Cueball: Oh my God! We handed control of our social world to Facebook and they're ''DOING EVIL STUFF!''

:Bearded Fellow: Do you see this?

:[Inset, the bearded fellow rubs his index and middle fingers against his thumb.]
:Bearded Fellow: ''It's the world's tiniest open-source violin.''

{{comic discussion}}
[[Category:Comics featuring Cueball]]
[[Category:Programming]]
[[Category:Social networking]]

1286: Encryptic

2013-11-04T23:03:18Z

108.162.216.228: /* Passwords */ less nattery wording

{{comic
| number = 1286
| date = November 4, 2013
| title = Encryptic
| image = encryptic.png
| titletext = It was bound to happen eventually. This data theft will enable almost limitless [xkcd.com/792]-style password reuse attacks in the coming weeks. There's only one group that comes out of this looking smart: Everyone who pirated Photoshop.
}}

==Explanation==
{{w|Triple DES}} is an older but still relatively secure encryption algorithm that works on 64-bit (8 character) blocks. Assuming that the passwords are stored in plain ASCII, this means that each sequence of 8 characters on the same position is always encrypted to the same result and therefore two passwords starting with “12345678” would start with the same block after being encrypted. Furthermore, this means that you can actually get a very good idea of the length of the password since anything with only one block is a password with length between 1 and 8 characters, with two blocks it has between 9 and 16 characters etc.

This way of storing passwords does not follow the recommended way of using a suitable cryptographically-secure {{w|Hash function|hash function}} that yields only a single block so that there is no way to tell the length of the password from the result. It is also a good practice to {{w|Salt (cryptography)|add a salt}} specific to each user (like their username) so that two users with the same password would not have the same hash.

Adobe also stored hints users created for their passwords. That means that an attacker knows not only if the same 8 characters are used for multiple passwords but also has some hints for guessing them. That means that common password portions should be easy to recover and that any user may be “compromised” by someone else using a part of the same password and providing a good hint. As an example, a password having three hints “Big Apple”, “Twin Towers” and “If you can make it there” is probably “New York” (or a simple variation on that). The weakness here is that no decryption and therefore no hard cracking has to take place, you just group the passwords by their encrypted blocks and try to solve them like a crossword puzzle.

It seems the examples are not taken from the actual leaked file as that [http://arstechnica.com/security/2013/11/how-an-epic-blunder-by-adobe-could-strengthen-hand-of-password-crackers/ uses a different format].

The title text makes a reference to [[792|Black Hat’s trouble with what to do with stolen passwords]]. It also states that users of pirated Photoshop are the winners here. This is because in order to make Photoshop pirate-able, it was modified (cracked) by removing the requirement for registration so their passwords were not sent to Adobe and therefore are not present in the leaked file.

The title itself is a reference to [http://en.wikipedia.org/wiki/Cryptic_crossword cryptic crosswords]

==Passwords==
Note that characters in the passwords could be upper or lower case, and they may involve common substitutions like "0" (number zero) for "O" (letter O); therefore, the clues cannot guarantee that the answer shown here is precisely correct. Nevertheless, we have plenty of information for a brute force attack.

{|class="wikitable"
! Input
! Hint
! Password
! Explanation
|-
|<tt>4e18acc1ab27a2d6</tt>
|weather vane sword
|<tt>matthias</tt>
|In ''Redwall'', several characters are associated with a sword hung from a weather vane, but only Matthias shares the name of an apostle (6 lines down).
|-
|<tt>4e18acc1ab27a2d6</tt>
|
|<tt>matthias</tt>
|Although no hint was used, we know this password too, since it matches the previous one.
|-
|<tt>4e18acc1ab27a2d6 a0a2876eb1ea1fea</tt>
|name1
|<tt>matthias1</tt>
|Even without knowing the user's name, we already know how this starts, so the clue gives us a pretty good idea how it finishes (and another block useful 2 lines down)
|-
|<tt>8babb6299e06eb6d</tt>
|duh
|<tt>password</tt>
|Unfortunately, this is all too common, and the user practically told us that it's an easy one.
|-
|<tt>8babb6299e06eb6d a0a2876eb1ea1fea</tt>
|
|<tt>password1</tt>
|Although no hint was used, we know this by combining the previous two.
|-
|<tt>8babb6299e06eb6d 85e9da81a8a78adc</tt>
|57
|<tt>password57</tt>
|Since we know how this begins, this is a good guess.
|-
|<tt>4e18acc1ab27a2d6</tt>
|favorite of 12 apostles
|<tt>matthias</tt>
|This has only 12 possibilities to begin with (plus variant spellings, variant lists, and one replacement), but actually we know already which one by combining with the clue 6 lines up.
|-
|<tt>1ab29ae86da6e5ca 7a2d6a0a2876eb1e</tt>
|with your own hand you have done all this
|<tt>Judith1510</tt>
|This is a quotation from Judith 15:10.
|-
|<tt>a1f9b2b6299e7a2b eadec1e6ab797397</tt>
|sexy earlobes
|<tt>Charlie Sheen</tt>
|This refers to an episode of ''Two and a Half Men''. Other answers are possible, but only this one fits the next line.
|-
|<tt>a1f9b2b6299e7a2b 617ab0277727ad85</tt>
|best TOS episode
|<tt>Charlie X</tt>
|"TOS" refers to the original series of ''Star Trek''. Although this had dozens of episodes, only one fits the previous line.
|-
|<tt>39738b7adb0b8af7 617ab0277727ad85</tt>
|Sugarland
|<tt>HoustonTX</tt>
|Sugarland is a suburb of Houston, Texas. This fits with the previous line.
|-
|<tt>1ab29ae86da6e5ca</tt>
|name + jersey#
|<tt>Judith15</tt>
|Even if we knew this user's name, we wouldn't know their jersey number. But the clue 4 lines up already gave us the answer.
|-
|<tt>877ab7889d3862b1</tt>
|alpha
|<tt>abc</tt>
|This password is also far too common, but this clue still isn't enough to narrow it down. Combine with the clue 3 lines below, however, and it's quite easy.
|-
|<tt>877ab7889d3862b1</tt>
|
|<tt>abc</tt>
|No hint, but the same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|
|<tt>abc</tt>
|No hint, but the same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|Michael Jackson
|<tt>abc</tt>
|Michael Jackson did many songs, but only one was alphabetical (3 lines up).
|-
|<tt>38a7c9279cadeb44 9dca1d79d4dec6d5</tt>
|
|
|No hint, but the same as the one below.
|-
|<tt>38a7c9279cadeb44 9dca1d79d4dec6d5</tt>
|he did the MASH, he did the
|<tt>Monster Mash</tt>
|
|
|-
|<tt>38a7c9279cadeb44</tt>
|Purloined
|
|
|-
|<tt>a8ae5754a2b7af7a 9dca1d79d4dec6d5</tt>
|fav water-3 Pokemon
|
|
|-
|}

==Transcript==
:Hackers recently leaked '''''153 million''''' Adobe user emails, encrypted passwords, and password hints.
:Adobe encrypted the passwords improperly, misusing block-mode 3DES. The result is something wonderful:

<pre>
User password Hint
------------- ----

4e18acc1ab27a2d6 weather vane sword
4e18acc1ab27a2d6
4e18acc1ab27a2d6 a0a2876eb1ea1fea name1
8babb6299e06eb6d duh
8babb6299e06eb6d a0a2876eb1ea1fea
8babb6299e06eb6d 85e9da81a8a78adc 57
4e18acc1ab27a2d6 favorite of 12 apostles
1ab29ae86da6e5ca 7a2d6a0a2876eb1e with your own hand you
have done all this
a1f9b2b6299e7a2b eadec1e6ab797397 sexy earlobes
a1f9b2b6299e7a2b 617ab0277727ad85 best tos episode
39738b7adb0b8af7 617ab0277727ad85 sugarland
1ab29ae86da6e5ca name + jersey#
877ab7889d3862b1 alpha
877ab7889d3862b1
877ab7889d3862b1
877ab7889d3862b1 obvious
877ab7889d3862b1 Michael Jackson
38a7c9279cadeb44 9dca1d79d4dec6d5
38a7c9279cadeb44 9dca1d79d4dec6d5 he did the MASH, he did the
38a7c9279cadeb44 Purloined
a8ae5754a2b7af7a 9dca1d79d4dec6d5 fav water-3 pokemon
</pre>

:The greatest crossword puzzle in the history of the world

{{comic discussion}}

[[Category:Comics with color]]