explain xkcd - User contributions [en]

Talk:1286: Encryptic

2013-11-05T01:56:41Z

BozoTheScary:

The answer to the weathervane sword/ favorite apostle hint has got to be Matthias. It is 8 characters long, Matthias was the apostle chosen to replace Judas and in the Redwall series Matthias is one of the wielders of the Sword of Martin a sword that was hung on a weathervane.

It is unclear to me if these are actual hashes from Adobe file? That would be very cool... but actual file seems to have passwords in slightly different format. http://arstechnica.com/security/2013/11/how-an-epic-blunder-by-adobe-could-strengthen-hand-of-password-crackers/ [[Special:Contributions/108.162.229.211|108.162.229.211]] 09:05, 4 November 2013 (UTC) pavel

:I wouldn't call 3DES secure ... but yes, in this situation the real problem is not using per-user salt. Note that I would expect that at least some of those examples would be solvable ...any idea? Hmmm ... sword of weather vane and one of apostles might be Martin ([http://redwall.wikia.com/wiki/Sword_of_Martin]) ... -- [[User:Hkmaly|Hkmaly]] ([[User talk:Hkmaly|talk]]) 10:00, 4 November 2013 (UTC)

::It's Jonathon (for John). Not sure what it has to do with weather vane swords though... [[Special:Contributions/108.162.240.18|108.162.240.18]] 12:42, 4 November 2013 (UTC)

:Umm. "Peter" does not seem to have 8 characters, does it? Encryption method suggests it should be 8 characters, as do 8 character boxes on the right... [[Special:Contributions/108.162.229.211|108.162.229.211]] 10:43, 4 November 2013 (UTC) pavel

::I'd say "weather vane sword", "name1" and "favorite of 12 apostles" is (Saint) Peter. "Weather vane" as symbol for the rooster in the denial, and the sword Peter used when Jesus was arrested. --[[Special:Contributions/108.162.254.177|108.162.254.177]] 10:25, 4 November 2013 (UTC)

::: ... interesting that google search didn't mentioned it :-) Seems bible have too low pagerank. -- [[User:Hkmaly|Hkmaly]] ([[User talk:Hkmaly|talk]]) 10:32, 4 November 2013 (UTC)

::: The 'favourite' apostle was John the Evangelist though. http://en.wikipedia.org/wiki/Disciple_whom_Jesus_loved . The other biblical clue here is 'with your own hand you have done all this' - Judith 15:10. If that's Judith1510 then the 'name and shirt number' is 'Judith15'. The TOS/earlobes clue seems to be "Spock's brain" and "Spock's (ears?)". And the Michael Jackson one is (obviously) ABC123. [[Special:Contributions/141.101.99.214|141.101.99.214]] 11:14, 4 November 2013 (UTC)
:::: Perhaps "favorite" in this case refer's to the user's favorite, not Jesus's. [[User:Yomikoma|Yomikoma]] ([[User talk:Yomikoma|talk]]) 16:13, 4 November 2013 (UTC)
:::: The Michael Jackson password should just be "ABC". (The other clue refers only to letters, and the proper song title also has only letters.) —[[User:TobyBartels|TobyBartels]] ([[User talk:TobyBartels|talk]]) 20:57, 4 November 2013 (UTC)
::: Given that name1 is two blocks long, I would guess that the apostle's name is going to be eight characters long, with the second hash block being 1+seven spaces (or nulls if Adobe pads it with nulls and not spaces). But then again, as the only disciple with a name eight letters long is Thaddeus maybe not {{unsigned ip|141.101.99.214}}

:::: "St.Peter" is 8 characters, and having a "special" character (the period) makes it a good choice for passwords that might require 1 non-alphanumeric character (and ban spaces). [[Special:Contributions/141.101.99.223|141.101.99.223]] 11:47, 4 November 2013 (UTC)

:::: I think it is obvious that Name1 refers to {The user's name} + 1. I wonder though if we should be referring to one of the other 12 apostles in a different context? https://en.wikipedia.org/wiki/Twelve_Apostles_%28disambiguation%29 - [[Special:Contributions/108.162.242.11|108.162.242.11]] 18:02, 4 November 2013 (UTC)
::::: Is the "weathervane sword" referring to Redwall? I haven't read the book myself, but would it be referring to the "Sword of Martin"? [http://redwall.wikia.com/wiki/Sword_of_Martin] --[[User:Jeff|Jeff]] ([[User talk:Jeff|talk]]) 19:17, 4 November 2013 (UTC)

Another article about using passwords hints from multiple users to find the passwords from the breach. http://7habitsofhighlyeffectivehackers.blogspot.com/2013/11/can-someone-be-targeted-using-adobe.html [[User:Bugefun|Bugefun]] ([[User talk:Bugefun|talk]]) 11:06, 4 November 2013 (UTC)

"Sexy earlobes" makes me think of [http://misswiu.livejournal.com/5385.html "The ABC of Aerobics"], but that would make that Shirley Clarke, and nothing in Star Trek has anything to do with Shirley that I am aware of, except possible [http://en.memory-alpha.org/wiki/Ruth Shirley Bonne as Ruth]. I skimmed a list of episode titles, but nothing jumps out at me as particularly earlobish. [[Special:Contributions/108.162.219.187|108.162.219.187]] 11:20, 4 November 2013 (UTC)

:Sexy earlobes might have something to do with Ferengi, but they didn't appeared in TOS. 141.101.99.214's idea is better. -- [[User:Hkmaly|Hkmaly]] ([[User talk:Hkmaly|talk]]) 11:42, 4 November 2013 (UTC)

:OK, we know that "sexy earlobes" and "best TOS Episode" are the same for the first eight character, but differ after that, while "best TOS" and "sugarland" are the same after the first 8 characters. So, my guesses are : Best TOS episode: "Charlie X"; "Sexy Earlobes": Someone with the first name of "Charlie"; "Sugarland": some city in Texas (perhaps "HoustonTX") [[User:JamesCurran|JamesCurran]] ([[User talk:JamesCurran|talk]]) 16:51, 4 November 2013 (UTC)

Note that you should not ever use cipher in {{w|Block_cipher_mode_of_operation#Electronic_codebook_.28ECB.29|ECB (electronic codebook)}} mode, i.e. encrypt each block separately and independently, but use chaining. --[[User:JakubNarebski|JakubNarebski]] ([[User talk:JakubNarebski|talk]]) 12:15, 4 November 2013 (UTC)
: And for passwords you shouldn't be using a cipher at all, but rather a hash function. (Or a cipher in one of the approved hash constructions, if you must.) And really you shouldn't be using a standard hash function, but be following best practices for passwords instead: salting the hash, using a *slow* hash function, etc. [[User:Cscott|Cscott]] ([[User talk:Cscott|talk]]) 20:22, 4 November 2013 (UTC)

Hmm, i'm rather confused about the last few on the list though. Assumedly the password for "he did the mash, he did the" would be "monster mash", but that would leave "purloined" with a password of either "monsterm" or "monster ". which doesn't make much sense. [[Special:Contributions/108.162.240.18|108.162.240.18]] 13:47, 4 November 2013 (UTC)

(charlie sheen) a1f9b2b6299e7a2b eadec1e6ab797397 sexy earlobes - He did a 2 and a half men episode on sexy earlobes
:(charlie x) a1f9b2b6299e7a2b 617ab0277727ad85 best tos episode - Star Trek has so many good episodes...
::(houstontx) 39738b7adb0b8af7 617ab0277727ad85 sugarland - Sugarland is in Houston, TX

I don't know about anyone else, but the "hints" column incidentally reminded me of {{w|Darwinian poetry|Darwinian Poetry}}... Not intentionally, I'm sure. [[Special:Contributions/141.101.98.214|141.101.98.214]] 14:46, 4 November 2013 (UTC)

Somehow I've missed out on this issue until this comic alerted me to it, but: once a few passwords are correctly guessed, does that make it straightforward to recover the encryption key, and then be able to decrypt '''all''' of them? —[[User:Scs|scs]] ([[User talk:Scs|talk]]) 14:50, 4 November 2013 (UTC)

: Answering my own question: not really straightforward, no. 3DES is still pretty strong, and what knowing a few passwords gives you is a known-plaintext attack, which helps a little, but is by no means a giveaway. —[[User:Scs|scs]] ([[User talk:Scs|talk]]) 15:00, 4 November 2013 (UTC)

:: Note that if blackhat used this service, he would know at least one plaintext - his own password--[[User:JakubNarebski|JakubNarebski]] ([[User talk:JakubNarebski|talk]]) 15:05, 4 November 2013 (UTC)

:No, for calculating the encryption key of Triple DES, there is no real benefit in knowing million passwords, you would still need to brute force it. You would need to know at least 232 different passwords to make it easier but you can't do that with the leaked file (there are about 30 times less of them and moreover many of them are not unique). [[User:Sten|'''STEN''']] ([[User talk:Sten|talk]]) 16:08, 4 November 2013 (UTC)

Okay, so the first column is the encrypted password, the second one is the hint chosen by user. What do rectangles mean? [[Special:Contributions/173.245.53.151|173.245.53.151]] 15:28, 4 November 2013 (UTC)
:That are the fields to fill the characters in just as you do in a crossword puzzle. There are small fields at the beginning that take one character each and one large field at the end that takes one to eight characters. [[User:Sten|'''STEN''']] ([[User talk:Sten|talk]]) 15:32, 4 November 2013 (UTC)

Water 3 is an egg group: http://bulbapedia.bulbagarden.net/wiki/Water_3_(Egg_Group) . Given the length of the key, it will probably be 9-16 characters. (Crawdaunt, tentacool, and tentacruel are most likely) [[Special:Contributions/199.27.128.139|199.27.128.139]] 15:43, 4 November 2013 (UTC)
:-- which means 9dca1d79d4dec6d5 is either L, EL, or T, but I can't find a way for that to match up with any variation of "monster mash." [[Special:Contributions/173.245.55.209|173.245.55.209]] 16:15, 4 November 2013 (UTC)
:: Same problem here... Monster mash must not be correct, but it is one of the easier ones, I can't give up on it. --[[User:Jeff|Jeff]] ([[User talk:Jeff|talk]]) 17:35, 4 November 2013 (UTC)
::: Maybe, he did the MASH is about the book, movie or TV Show M*A*S*H instead? --[[User:Jeff|Jeff]] ([[User talk:Jeff|talk]]) 17:49, 4 November 2013 (UTC)
:: Monster Mash was written by Bobby Pickett, maybe it has something to do with him? [[User:Sten|'''STEN''']] ([[User talk:Sten|talk]]) 18:38, 4 November 2013 (UTC)
::: Maybe it's not "monster mash" but just "monster". This would allow the Water-3 Pokemon to be "Cloyster". [[Special:Contributions/108.162.237.5|108.162.237.5]] 19:17, 4 November 2013 (UTC)
:::: You are having trouble counting to eight. [[User:Cscott|Cscott]] ([[User talk:Cscott|talk]]) 20:22, 4 November 2013 (UTC)
::::: You are forgetting the space. Assuming space is stored as a null character, this might actually work.[[Special:Contributions/173.245.54.29|173.245.54.29]] 01:43, 5 November 2013 (UTC)

It seems to me there are two puzzles here, if folks are right that this is not actual data from the hack. 1) Figure out Adobe's master 3DES encryption password, for the big prize. 2) figure out Randall's 3DES encryption password for this puzzle based on these hints, and knowing it will be something clever. [[User:Nealmcb|Nealmcb]] ([[User talk:Nealmcb|talk]]) 16:12, 4 November 2013 (UTC)

Trying to decode the passwords (As Randall obviously wants us to)
"with your own hand you have done all this" is from the book of Judith.
Working on decoding the others. --[[User:Jeff|Jeff]] ([[User talk:Jeff|talk]]) 17:13, 4 November 2013 (UTC)

8babb6299e06eb6d = password
a0a2876eb1ea1fea = 1
85e9da81a8a78adc = 57
--[[User:Jeff|Jeff]] ([[User talk:Jeff|talk]]) 18:10, 4 November 2013 (UTC)

Weather Vane Sword may be a reference to Game of Thrones Ascent. The "Sworn Sword", I believe is "Rona" which is also a name. [[Special:Contributions/173.245.55.216|173.245.55.216]] 18:27, 4 November 2013 (UTC)
: It needs to be a name of an apostle (as per line 7) and have 7 or 8 characters (as line 3 needs a continuation) so this leaves Matthew, Thaddeus and (Judas) Iscariot. [[User:Sten|'''STEN''']] ([[User talk:Sten|talk]]) 18:57, 4 November 2013 (UTC)

If a password(or 8 character segment) is guessed can it be confirmed? Somebody should take this leaked list and create a website that presents it like in the comment and lets people guess. It can fill in the guessed ones. [[Special:Contributions/108.162.246.117|108.162.246.117]] 19:17, 4 November 2013 (UTC)

I'm putting in Mattias for the sword, name1 and disciple because of Saint Matthias [http://en.wikipedia.org/wiki/Saint_Matthias] and Redwall Matthias [http://redwall.wikia.com/wiki/Matthias] who held the Weathervane Sword (Also known as the sword of Martin [http://redwall.wikia.com/wiki/The_Sword_of_Martin] ) --[[User:Jeff|Jeff]] ([[User talk:Jeff|talk]]) 19:27, 4 November 2013 (UTC)
: I've also removed "monster mash" from the list as it can't be right. Doesn't match the pokemon or the purloined clues. --[[User:Jeff|Jeff]] ([[User talk:Jeff|talk]]) 19:27, 4 November 2013 (UTC)

Based on the Water-3 Pokemon hint, the only possibilities of more than 8 characters are tentacool, tentacruel, barbaracle, crawdaunt, carracosta, clauncher, and clawitzer. This would mean "9dca1d79d4dec6d5" would be l, el, le, t, ta, or r. --[[User:Dvorakmd|Dvorakmd]] ([[User talk:Dvorakmd|talk]]) 19:51, 4 November 2013 (UTC)
: This is assuming there are no characters before the actual name of the pokemon. [[Special:Contributions/173.245.55.209|173.245.55.209]] 20:30, 4 November 2013 (UTC)
: Assuming Randall has constructed this comic to have a unique answer, it can't end in r because then the clue would be ambiguous (could be clauncher or clawitzer). [[User:Cscott|Cscott]] ([[User talk:Cscott|talk]]) 21:53, 4 November 2013 (UTC)
: Some of these can be ruled out; it's very unlikely to be a Generation VI Pokémon (Barbaracle, Clauncher and Clawitzer) as this has only just come out and someone would have had to set up their pasword within the last few weeks. And the Pokémon that are also in the Water-1 group are probably more likely to be thought of as Water-1 than Water-3 (Crawdaunt and Carracosta). This only leaves Tentacool and Tentacruel as longer than 8 letter Water-3 only Pokémon that have been known of for a reasonable length of time; and Tentacool is no one's favourite, as the annoying multitude of them that show up whenever you try to Surf anyway makes them as reviled as Zubats in caves, if not moreso. :P Of course, the password need not be simply the Pokémon's name alone. "SexyShellder" "Cloyster1987" "Misty'sStarmie"... Who knows? [[Special:Contributions/141.101.99.252|141.101.99.252]] 01:03, 5 November 2013 (UTC)

I don't know the answer to the end either, but here's a list of people who did the Monster Mash, from Wikipedia:
* Bobby Picket (as Boris Picket)
* Garpax Records (Gary S. Paxton)
* The Misfits
* far, far too many other covers to list
And here's some synonyms for "purloined", from thesaurus.com:
* stole
* pilfered
* filched
* misappropriated
* embezzled
* burglarized
* shoplifted
* poached
* pillaged
* cheated
* pinched
* heisted
* thieved
* plundered
* appropriated
* lifted
* took
* snitched
* defrauded
* swindled
* ripped off
* made off with
Good luck with these!
—[[User:TobyBartels|TobyBartels]] ([[User talk:TobyBartels|talk]]) 20:31, 4 November 2013 (UTC)

What about Purloined referring to "The Purloined Letter?" When choosing hints, people, at least in my experience, tend to use word association rather than synonyms. [[Special:Contributions/173.245.55.209|173.245.55.209]]

Purloined could also be a reference to the Monster.com hack (http://www.symantec.com/connect/blogs/monster-trojan). [[Special:Contributions/108.162.237.11|108.162.237.11]] 21:00, 4 November 2013 (UTC)

Words meaning purloined that can have the listed suffixes could be '''embezzle'''/'''embezzler''' or '''scrounge'''/'''scrounger'''. Not sure if it fits to the mash clue. There was a loan shark character who would acquire things on MASH called Rizzo, it is a stretch though. [[Special:Contributions/108.162.246.117|108.162.246.117]] 21:01, 4 November 2013 (UTC)

I'm still trying to figure out how the solutions go into the spaces on the right -- it may be more obvious once the last couple clues are figured out. I suspect the ordering and numbers of clues have some sort of meaning. Why are there 5 of the 877... passwords, 2 with no clues? Why is one of the 4e18.... passwords separated from the rest? [[Special:Contributions/108.162.221.28|108.162.221.28]] 21:07, 4 November 2013 (UTC)

Could Purloined be a reference to the "Purloined Shadows" book in Elder Scrolls? --[[User:Dvorakmd|Dvorakmd]] ([[User talk:Dvorakmd|talk]]) 21:09, 4 November 2013 (UTC)
: Or 'The Purloined Payroll', a WoW quest? "Purloined in Petrograd" is also a lyric to a Decemberists song (The Bagman's Gambit). Google n-grams suggests that "Purloined Image", and "purloined documents" are a Thing. [[User:Cscott|Cscott]] ([[User talk:Cscott|talk]]) 21:58, 4 November 2013 (UTC)

Purloined could be a reference to something that is known as have been stolen like a work of art, or it could be something that was stolen in an XKCD comic. [[Special:Contributions/108.162.246.117|108.162.246.117]] 21:18, 4 November 2013 (UTC)

'''EdgarPoe'''(author of The Purloined Letter)/'''EdgarPoet''' fits, but again not really anything to do with MASH. [[Special:Contributions/108.162.246.117|108.162.246.117]] 21:27, 4 November 2013 (UTC)

Water-3 pokemon (egg group) are given here: http://bulbapedia.bulbagarden.net/wiki/Water_3_(Egg_Group) ...if I split off the letters of their names after the 8th letter, we see l, el, le, t, ta, and r. So the MASH item ends with one of those suffixes. [[Special:Contributions/199.27.128.167|199.27.128.167]] 21:31, 4 November 2013 (UTC)
: Can't end in 'r', because then that clue would be ambiguous. [[User:Cscott|Cscott]] ([[User talk:Cscott|talk]]) 21:53, 4 November 2013 (UTC)
: Speaking of pokemon, could the clue to purloined have something to do with the pokemon Purrloin? http://bulbapedia.bulbagarden.net/wiki/Purrloin_(Pok%C3%A9mon) [[Special:Contributions/108.162.221.43|108.162.221.43]] 23:51, 4 November 2013 (UTC)

Is there a reason "MASH" is capitalized in the above sections? Given the context, it shouldn't be, and I still haven't given up on the password being a reference to the monster mash. That said, we can't ignore the movie/show MASH.
Also, now that I think about it: pokeMONstermash? I don't know, just throwing ideas out :P [[Special:Contributions/173.245.55.209|173.245.55.209]] 22:08, 4 November 2013 (UTC)

On [http://de.reddit.com/r/programming/comments/1pvwyf/xkcd_encryptic_analysis_at_the_link_below/ reddit] they suggest "Letterman" (which is wrong, too many letters) based on the M*A*S*H episode, "Letters". [[User:Cscott|Cscott]] ([[User talk:Cscott|talk]]) 22:11, 4 November 2013 (UTC)
:...on the other hand, I wonder if an answer like "ALANALDA" would work? As in, someone who "did the M*A*S*H"... [[User:Cscott|Cscott]] ([[User talk:Cscott|talk]]) 22:13, 4 November 2013 (UTC)
:: Sadly, no. Because it needs to be more than 8 characters. --[[User:Jeff|Jeff]] ([[User talk:Jeff|talk]]) 22:17, 4 November 2013 (UTC)
::: No, I mean, "an answer of this form", not ALANALDA exactly. The Edgar Allan / Alan Alda congruence is tasty, but I can't make it work. ALLANPOE works as an answer for "Purloined" but that makes something like ALLANPOET the answer to "he did the MASH" (CRAWDAUNT is then the pokemon). But that's misspelling Alda's name for the MASH clue, doesn't quite work. There's also JAMIEFARR (Cpl Klinger) as a better answer to "he did the MASH" but then that makes JAMIEFAR the answer to "purloined" and I can't plausibly make that work. ALLANARBUS is another M*A*S*H actor, but that doesn't work at all. Can anyone come up with other/better ideas in this vein? [[User:Cscott|Cscott]] ([[User talk:Cscott|talk]]) 22:31, 4 November 2013 (UTC)

In crossword puzzles, a clue ending in -ed (like 'purloined') is most commonly a hint that the answer ends in 'ed'. Cross referencing that with the Pokemon clue, the solution for "he did the MASH" becomes a nine or ten letter answer ending in: -edl, -edel, -edle, -edt, or -edta (excluding -edr due to non-uniqueness), with ......edle looking the most "English-y" to me. My hunch would be something else Robert Altman or Alan Alda "did"... but nothing seems to end in 'edle.' --[[User:Willowy burrito|Willowy burrito]] ([[User talk:Willowy burrito|talk]]) 23:07, 4 November 2013 (UTC)
: There is no indication that this is a standard crossword. Most users don't respect crossword conventions when writing password hints. [[User:Cscott|Cscott]] ([[User talk:Cscott|talk]]) 23:59, 4 November 2013 (UTC)
:: Aside from the title. And the text. And the fact these didn't come from users, but were just chosen for a puzzle designed by Randall, who would include just this sort of puzzler hint/in-joke in a comic about puzzles. It's moot, because no synonyms for 'stolen' make any sense with a couple other letters tacked on the end. But still, there've been worse hunches. --[[User:Willowy burrito|Willowy burrito]] ([[User talk:Willowy burrito|talk]]) 00:45, 5 November 2013 (UTC)

For all we know, his favourite Water-3 Pokémon could be Shell Smash Cloyster or Shell Smash Omastar - "OmastarSmash" as a password would fit in with "Monster mash". [[Special:Contributions/141.101.99.252|141.101.99.252]] 23:16, 4 November 2013 (UTC)
: I like that idea, although it leaves "Monster " (with a trailing space) as the answer to "Purloined", which makes no sense. But interesting idea. [[User:Cscott|Cscott]] ([[User talk:Cscott|talk]]) 00:00, 5 November 2013 (UTC)

MonsterMash
MonsterM
TheWiscash {{unsigned|Jcupcake}}
: It's "Whiscash", and it's Water 2 (not 3) and "MonsterM" makes no sense as an answer for the hint "Purloined". But I like the idea of adding "The" in front of the pokemon answer; perhaps we're being too restrictive by looking only at pokemon with length > 8. [[User:Cscott|Cscott]] ([[User talk:Cscott|talk]]) 23:59, 4 November 2013 (UTC)

So somewhere above this someone pointed out that purloined could refer to a monster.com hack...in which case, could the first two passwords be "monster mash" and "monster"? That would allow for another previous suggestion of "OmastarSmash" Also, here's my IP Address and a remarkably not-random timestamp: [[Special:Contributions/108.162.219.195|108.162.219.195]] 01:31, 5 November 2013 (UTC)

It could also be that there are modifiers to the base. I always thought of Monster Mash as MonstaMash. This would line up closely with My Corphish written as "mycorphish" My favorite pokemon is my pikachu not just any pikachu, but mine, sort of logic. [[User:Bitassassin|Bitassassin]] ([[User talk:Bitassassin|talk]]) 01:43, 5 November 2013 (UTC)

;Fanservice

Randall must know about this site. This comic doesn't work without people to crack the code. Should we have a fanservice category? :-) --[[User:SurturZ|SurturZ]] ([[User talk:SurturZ|talk]]) 23:32, 4 November 2013 (UTC)

I'm beginning to suspect that the wide boxes will have the key in it. Assuming he used regular DES (or DES3, for that matter, but using the same 8-byte key 3 times), it could be plausible. The 5 in the middle could be 'abcde', a lot of the other 'second halves' are numbers, and the likely known one that's not seems to be an 'x' -- which could certainly be involved in writing a hex number... problem is there's 11 of those boxes. Trying to guess what signficance the positioning of those boxes have. [[Special:Contributions/108.162.221.28|108.162.221.28]] 00:00, 5 November 2013 (UTC)

Actually, it looks like the boxes line up perfectly such that the wide bits (for second-half) will only touch the words they apply to. Order will be more or less what they are (I see the wide boxes as, in order, 1, 57, 10, Sheen, and X, with the 8 char boxes as Matthias, Password, Judith15, Charlie, and HoustonT). The next 5 are odd -- I'm not sure if we repeat the alpha/obvious password 5 times, or it's 5 chars long (abcde) and one per box. The last set is still under discussion, of course. [[Special:Contributions/108.162.221.28|108.162.221.28]] 00:20, 5 November 2013 (UTC)

== MASH capitalized ==
I'm currently chasing down the idea that MASH refers to [[Wikipedia:MASH-1]]. Haven't seen any name yet that looks like it might satisfy "Purloined". - [[User:BozoTheScary|BozoTheScary]] ([[User talk:BozoTheScary|talk]]) 01:56, 5 November 2013 (UTC)

1286: Encryptic

2013-11-04T23:18:05Z

BozoTheScary: /* Passwords */

{{comic
| number = 1286
| date = November 4, 2013
| title = Encryptic
| image = encryptic.png
| titletext = It was bound to happen eventually. This data theft will enable almost limitless [xkcd.com/792]-style password reuse attacks in the coming weeks. There's only one group that comes out of this looking smart: Everyone who pirated Photoshop.
}}

==Explanation==
{{w|Triple DES}} is an older but still relatively secure encryption algorithm that works on 64-bit (8 character) blocks. Assuming that the passwords are stored in plain ASCII, this means that each sequence of 8 characters on the same position is always encrypted to the same result and therefore two passwords starting with “12345678” would start with the same block after being encrypted. Furthermore, this means that you can actually get a very good idea of the length of the password since anything with only one block is a password with length between 1 and 8 characters, with two blocks it has between 9 and 16 characters etc.

This way of storing passwords does not follow the recommended way of using a suitable cryptographically-secure {{w|Hash function|hash function}} that yields only a single block so that there is no way to tell the length of the password from the result. It is also a good practice to {{w|Salt (cryptography)|add a salt}} specific to each user (like their username) so that two users with the same password would not have the same hash.

Adobe also stored hints users created for their passwords. That means that an attacker knows not only if the same 8 characters are used for multiple passwords but also has some hints for guessing them. That means that common password portions should be easy to recover and that any user may be “compromised” by someone else using a part of the same password and providing a good hint. As an example, a password having three hints “Big Apple”, “Twin Towers” and “If you can make it there” is probably “New York” (or a simple variation on that). The weakness here is that no decryption and therefore no hard cracking has to take place, you just group the passwords by their encrypted blocks and try to solve them like a crossword puzzle.

It seems the examples are not taken from the actual leaked file as that [http://arstechnica.com/security/2013/11/how-an-epic-blunder-by-adobe-could-strengthen-hand-of-password-crackers/ uses a different format].

The title text makes a reference to [[792|Black Hat’s trouble with what to do with stolen passwords]]. It also states that users of pirated Photoshop are the winners here. This is because in order to make Photoshop pirate-able, it was modified (cracked) by removing the requirement for registration so their passwords were not sent to Adobe and therefore are not present in the leaked file.

The title itself is a reference to [http://en.wikipedia.org/wiki/Cryptic_crossword cryptic crosswords]

==Passwords==
Note that characters in the passwords could be upper or lower case, and they may involve common substitutions like "0" (number zero) for "O" (letter O); therefore, the clues cannot guarantee that the answer shown here is precisely correct. Nevertheless, we have plenty of information for a brute force attack.

{|class="wikitable"
! Input
! Hint
! Password
! Explanation
|-
|<tt>4e18acc1ab27a2d6</tt>
|weather vane sword
|<tt>matthias</tt>
|In ''Redwall'', several characters are associated with a sword hung from a weather vane, but only Matthias shares the name of an apostle (6 lines down).
|-
|<tt>4e18acc1ab27a2d6</tt>
|
|<tt>matthias</tt>
|Although no hint was used, we know this password too, since it matches the previous one.
|-
|<tt>4e18acc1ab27a2d6 a0a2876eb1ea1fea</tt>
|name1
|<tt>matthias1</tt>
|Even without knowing the user's name, we already know how this starts, so the clue gives us a pretty good idea how it finishes (and another block useful 2 lines down)
|-
|<tt>8babb6299e06eb6d</tt>
|duh
|<tt>password</tt>
|Unfortunately, this is all too common, and the user practically told us that it's an easy one.
|-
|<tt>8babb6299e06eb6d a0a2876eb1ea1fea</tt>
|
|<tt>password1</tt>
|Although no hint was used, we know this by combining the previous two.
|-
|<tt>8babb6299e06eb6d 85e9da81a8a78adc</tt>
|57
|<tt>password57</tt>
|Since we know how this begins, this is a good guess.
|-
|<tt>4e18acc1ab27a2d6</tt>
|favorite of 12 apostles
|<tt>matthias</tt>
|This has only 12 possibilities to begin with (plus variant spellings, variant lists, and one replacement), but actually we know already which one by combining with the clue 6 lines up.
|-
|<tt>1ab29ae86da6e5ca 7a2d6a0a2876eb1e</tt>
|with your own hand you have done all this
|<tt>Judith1510</tt>
|This is a quotation from Judith 15:10.
|-
|<tt>a1f9b2b6299e7a2b eadec1e6ab797397</tt>
|sexy earlobes
|<tt>Charlie Sheen</tt>
|This refers to an episode of ''Two and a Half Men''. Other answers are possible, but only this one fits the next line.
|-
|<tt>a1f9b2b6299e7a2b 617ab0277727ad85</tt>
|best TOS episode
|<tt>Charlie X</tt>
|"TOS" refers to the original series of ''Star Trek''. Although this had dozens of episodes, only one fits the previous line.
|-
|<tt>39738b7adb0b8af7 617ab0277727ad85</tt>
|Sugarland
|<tt>HoustonTX</tt>
|Sugarland is a suburb of Houston, Texas. This fits with the previous line.
|-
|<tt>1ab29ae86da6e5ca</tt>
|name + jersey#
|<tt>Judith15</tt>
|Even if we knew this user's name, we wouldn't know their jersey number. But the clue 4 lines up already gave us the answer.
|-
|<tt>877ab7889d3862b1</tt>
|alpha
|<tt>abc</tt>
|This password is also far too common, but this clue still isn't enough to narrow it down. Combine with the clue 3 lines below, however, and it's quite easy.
|-
|<tt>877ab7889d3862b1</tt>
|
|<tt>abc</tt>
|No hint, but the same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|
|<tt>abc</tt>
|No hint, but the same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|Michael Jackson
|<tt>abc</tt>
|Michael Jackson did many songs, but only one was alphabetical (3 lines up).
|-
|<tt>38a7c9279cadeb44 9dca1d79d4dec6d5</tt>
|
|
|No hint, but the same as the one below.
|-
|<tt>38a7c9279cadeb44 9dca1d79d4dec6d5</tt>
|he did the MASH, he did the
|<tt>Monster Mash</tt>
|''may refer to [[Wikipedia:MASH-1]]''
|
|-
|<tt>38a7c9279cadeb44</tt>
|Purloined
|
|
|-
|<tt>a8ae5754a2b7af7a 9dca1d79d4dec6d5</tt>
|fav water-3 Pokemon
|
|''possible second block per [http://bulbapedia.bulbagarden.net/wiki/Water_3_%28Egg_Group%29 Bulbapedia] are "el", "l", "le", "r", "t", "ta"''
|-
|}

==Transcript==
:Hackers recently leaked '''''153 million''''' Adobe user emails, encrypted passwords, and password hints.
:Adobe encrypted the passwords improperly, misusing block-mode 3DES. The result is something wonderful:

<pre>
User password Hint
------------- ----

4e18acc1ab27a2d6 weather vane sword
4e18acc1ab27a2d6
4e18acc1ab27a2d6 a0a2876eb1ea1fea name1
8babb6299e06eb6d duh
8babb6299e06eb6d a0a2876eb1ea1fea
8babb6299e06eb6d 85e9da81a8a78adc 57
4e18acc1ab27a2d6 favorite of 12 apostles
1ab29ae86da6e5ca 7a2d6a0a2876eb1e with your own hand you
have done all this
a1f9b2b6299e7a2b eadec1e6ab797397 sexy earlobes
a1f9b2b6299e7a2b 617ab0277727ad85 best tos episode
39738b7adb0b8af7 617ab0277727ad85 sugarland
1ab29ae86da6e5ca name + jersey#
877ab7889d3862b1 alpha
877ab7889d3862b1
877ab7889d3862b1
877ab7889d3862b1 obvious
877ab7889d3862b1 Michael Jackson
38a7c9279cadeb44 9dca1d79d4dec6d5
38a7c9279cadeb44 9dca1d79d4dec6d5 he did the MASH, he did the
38a7c9279cadeb44 Purloined
a8ae5754a2b7af7a 9dca1d79d4dec6d5 fav water-3 pokemon
</pre>

:The greatest crossword puzzle in the history of the world

{{comic discussion}}

[[Category:Comics with color]]

1253: Exoplanet Names

2013-08-19T19:03:29Z

BozoTheScary: /* Explanation */

{{comic
| number = 1253
| date = August 19, 2013
| title = Exoplanet Names
| image = exoplanet names.png
| titletext = If you have any ideas, I hear you can send them to <nowiki>iaupublic@iap.fr</nowiki>.
}}
==Explanation==
{{incomplete|1253: Exoplanet Names}}

On the 14th of August, the {{w|International Astronomical Union}} [http://www.iau.org/science/news/179/ issued a document] about public naming of astronomical objects. It stated, "IAU fully supports the involvement of the general public, whether directly or through an independent organised vote, in the naming of planetary satellites, newly discovered planets, and their host stars.". It also contained, amongst other things, guidelines that suggested names should meet. These include stipulations such as "16 characters or less", "preferably one word", "not too similar to an existing name of an astronomical object" and "be respectful of intellectual property". If we go down the list, we can see that many of Randall's suggestions do indeed violate the guidelines. Which is probably part of the joke.

And yes, the document also states that suggestions may be sent to the email mentioned in the title text.

{| class="wikitable"
|-
! Star !! Planet !! Suggested Name !! Explanation
|-
| rowspan=7 | {{w|Gliese 667 C}} || {{w|Gliese 667 Cb|b}} || Space Planet || A very unoriginal name: Every planet is in space.
|-
| {{w|Gliese 667 Cc|c}} || PILF || Pun of {{w|MILF}}, i.e. ''Planet I'd Like to Fuck''. Planet c is a relatively hot planet, within the habitable zone.
|-
| {{w|Gliese 667 Cd|d}} || A Star ||
|-
| {{w|Gliese 667 Ce|e}} || e'); DROP TABLE PLANETS;-- || A reference to {{w|SQL injection}}, riffing off of [[327|comic 327]], which featured a boy named <code>[[Robert'); DROP TABLE students;--]]</code>. The idea here is that the IAU would enter the name into their system and promptly lose all of their data pertaining to planets. Note that Planet e is located in the habitable zone of the star system.
|-
| {{w|Gliese 667 Cf|f}} || Blogosphere || rowspan = 2 | Weird ''{{w|blog}}''-related terms are a recurring theme in xkcd. See, for instance, [[181|comic 181]].
|-
| {{w|Gliese 667 Cg|g}} || Blogodrome
|-
| [http://exoplanet.eu/catalog/gj_667c_h/ h] || Earth ||
|-
| rowspan=5 | {{w|Tau Ceti}} || [http://exoplanet.eu/catalog/tau_cet_b/ b] || Sid Meier's Tau Ceti B || This refers to the game {{w|Sid Meier's Alpha Centauri}}.
|-
| [http://exoplanet.eu/catalog/tau_cet_c/ c] || Giant Dog Planet ||
|-
| [http://exoplanet.eu/catalog/tau_cet_d/ d] || Tiny Dog Planet ||
|-
| {{w|Tau Ceti e|e}} || Phil Plainet || {{w|Phil Plait}}.
|-
| {{w|Tau Ceti f|f}} || Unicode Snowman || The Unicode character [http://www.fileformat.info/info/unicode/char/2603/index.htm ☃] is a reference to the planet's estimated surface temperature of -40°C.
|-
| {{w|Gliese 832}} || {{w|Gliese 832 b|b}} || Asshole Jupiter
|-
| rowspan=6 | {{w|Gliese 581}} || {{w|Gliese 581 b|b}} || Waist-deep Cats ||
|-
| {{w|Gliese 581 c|c}} || Planet #14 ||
|-
| {{w|Gliese 581 d|d}} || Ballderaan || A {{w|wikt:balls|crude pun}} on the planet {{w|Alderaan}} from the ''{{w|Star Wars}}'' universe.
|-
| {{w|Gliese 581 e|e}} || {{w|Eternia}} Prime || A reference to the main planet of ''{{w|Masters of the Universe}}''.
|-
| {{w|Gliese 581 f|f}} || Taupe Mars || A reference to Kim Stanley Robinson's Mars trilogy (Red Mars, Green Mars, Blue Mars).
|-
| {{w|Gliese 581 g|g}} || Jelly Filled Planet || Possibly a reference to the conjecture that this tidally locked planet has an isolated habitable zone under the substellar point, akin to the pocket of jelly in a jelly doughnut.
|-
| rowspan=2 | {{w|Epsilon Eridani}} || {{w|Epsilon Eridani b|b}} || Skydot ||
|-
| {{w|Epsilon Eridani c#Planet_c|c}} || Laser Noises ||
|-
| rowspan=2 | {{w|Gliese 176}} || {{w|Gliese 176 b|b}} || {{w|Fictional universe of Avatar|Pandora}} || The fictional planet in James Cameron's ''{{w|Avatar (film)|Avatar}}''. Also the Planet used in {{w|Borderlands (video game)| Borderlands Games}}.
|-
| [http://exoplanet.eu/catalog/gj_176_c/ c] || Pantera ||
|-
| Kepler-61 || {{w|Kepler-61b|b}} || Goldenpalace.com || A Gambling Site.
|-
! colspan=4 | ...
|-
| style="white-space:nowrap;" rowspan=3 | {{w|Upsilon Andromedae}} || {{w|Upsilon Andromedae c|c}} || Stampy ||
|-
| {{w|Upsilon Andromedae d|d}} || Moonchild ||
|-
| {{w|Upsilon Andromedae e|e}} || Ham Sphere ||
|-
| rowspan=3 | {{w|82 G. Eridani|HD 20794}} || [http://exoplanet.eu/catalog/hd_20794_b/ b] || Cosmic Sands || style="font-family:'Comic Sans MS', 'Comic Sans';" | A {{w|pun}} on the name of the font {{w|Comic Sans}}. (See also: [[590|590: Papyrus]].)
|-
| [http://exoplanet.eu/catalog/hd_20794_c/ c] || {{w|Legoland}} || {{w|Legoland}} is a chain of {{w|Theme_park|Theme Parks}} owned by the {{w|Lego Group}} and run by British company {{w|Merlin Entertainments}}.
|-
| [http://exoplanet.eu/catalog/hd_20794_d/ d] || Planet with Arms ||
|-
| {{w|HD 85512}} || {{w|HD 85512 b|b}} || Lax Morality ||
|-
| rowspan=6 | {{w|HD 40307}} || {{w|HD 40307 b|b}} || Good Planet ||
|-
| {{w|HD 40307 c|c}} || ProblemLand ||
|-
| {{w|HD 40307 d|d}} || Slickle ||
|-
| {{w|HD 40307 e|e}} || Spare Parts ||
|-
| {{w|HD 40307 f|f}} || New Jersey VI ||
|-
| {{w|HD 40307 g|g}} || How Do I Join the IAU ||
|-
| rowspan=3 | {{w|Gliese 163}} || [http://exoplanet.eu/catalog/gj_163_b/ b] || Neil Tyson's Mustache ||
|-
| {{w|Gliese 163 c|c}} || help@gmail.com ||
|-
| [http://exoplanet.eu/catalog/gj_163_d/ d] || Hair-Covered Planet
|-
| {{w|Pi Mensae}} || {{w|Pi Mensae b|b}} || Moon Holder ||
|-
| {{w|HD 189733}} || {{w|HD 189733 b|b}} || Permadeath ||
|-
| {{w|Kepler-22}} || {{w|Kepler-22 b|b}} || Blue Ivy || Blue Ivy Carter, daughter of musicians {{w|Beyoncé}} and {{w|Jay-Z}}.
|-
| Kepler-3284 || b || Blainsley ||
|-
| Kepler-3255 || b || Unicorn Thresher ||
|-
| Kepler-2418 || b || Spherical {{w|Discworld}} || A creation of British author {{w|Terry Pratchett|Sir Terry Pratchett}}, {{w|The Discworld}} is the fictional setting for his {{w|Discworld}} series of books and comprises of a large disc supported by four elephants themselves standing on top of a turtle flying through space.
|-
| Kepler-1686 || b || style="white-space:nowrap;" | Emergency Backup Earth ||
|-
| Kepler-3010 || b || Feeeoooooooop ||
|-
| Kepler-4742 || b || Liz ||
|}

==Transcript==
:August 2013:
:The International Astronomical Union decides to start naming exoplanets, and—for the first time ever—asks for suggestions from the general public.
:They immediately regret this decision.
:Cueball‏‎: Can't you filter out the worst ones?
:''The rightmost person'': This is '''''after''''' the filter!

{{comic discussion}}

[[Category:Comics featuring Cueball‏‎]]
[[Category:Comics featuring Megan]]
[[Category:Comics featuring Ponytail]]
[[Category:Astronomy]]