1286: Encryptic - Revision history

1234231587678 at 16:12, 23 February 2024

2024-02-23T16:12:03Z

172.69.22.21: There's no reason to keep the equals at the end of the b64-ed version in the "More readable" version of the encoded data

2024-01-21T04:58:17Z

There's no reason to keep the equals at the end of the b64-ed version in the "More readable" version of the encoded data

172.70.162.56: /* Explanation */ Local template wikilink

2023-03-16T20:18:47Z

‎Explanation: Local template wikilink

172.71.218.59: /* Explanation */ link to WP article for ECB

2023-03-16T13:48:15Z

‎Explanation: link to WP article for ECB

172.71.198.164: Undo revision 301306 by SilverTheTerribleMathematician (talk)

2022-12-30T16:10:05Z

Undo revision 301306 by SilverTheTerribleMathematician (talk)

SilverTheTerribleMathematician at 08:21, 14 December 2022

2022-12-14T08:21:24Z

ColorfulGalaxy: Cross-reference

2022-12-13T09:48:22Z

Cross-reference

Galaktos: /* Passwords */ add missing space and helpful wiktionary link

2022-12-12T00:41:05Z

‎Passwords: add missing space and helpful wiktionary link

Theusaf: Reverted edits by Donald Trump (talk) to last revision by CRLF

2022-05-26T19:57:43Z

Reverted edits by Donald Trump (talk) to last revision by CRLF

Show changes

Donald Trump: Reverted edit by anti-crap user

2022-05-26T19:04:32Z

Reverted edit by anti-crap user

Show changes

@@ Line 38: / Line 38: @@
 Soon after this comic was published, the most common 1000 passwords were actually compiled into [http://zed0.co.uk/crossword/ a set of 10 interactive online crosswords], inspired by the comic.
-The title itself is a reference to {{w|cryptic crossword}}s. (see [[2032]])
+The title itself is a reference to {{w|cryptic crossword}}s. (see [[2032: Word Puzzles]])
 ===Passwords===

@@ Line 27: / Line 27: @@
 And yet here we are
 XOXOXO
-Lets Live Here In This Tiny Secret Encoded Text World Forever==</pre>
+Lets Live Here In This Tiny Secret Encoded Text World Forever</pre>
 E.g., with the initial unique hash blocks: <tt>python2 -c "print '4e18acc1ab27a2d6a0a2876eb1ea1fca'.decode('hex_codec').encode('base64')"</tt>

@@ Line 12: / Line 12: @@
 Adobe, however, ignored these well-known principles, and instead stored over a hundred million passwords in a reversibly encrypted way, using a terrible choice of encryption methods which exposes a great deal of information about the passwords, and does not involve a salt. This password database was recently obtained by someone and released on the Internet.
-In particular, Adobe used {{w|Triple DES}}, an older encryption algorithm which can still be relatively secure when properly used, but they [[wikipedia:Electronic codebook|used it improperly]]. It works on 64-bit (8 character) blocks. Assuming that the passwords are stored in plain ASCII, this means that a sequence of 8 characters in a password which starts on a character position which is a multiple of eight is always encrypted to the same result. Therefore, two passwords starting with "12345678" would start with the same block after being encrypted. Furthermore, this means that you can actually get a very good idea of the length of the password since anything with only one block is a password with length between 1 and 8 characters, and having two blocks implies it has between 9 and 16 characters, etc.
+In particular, Adobe used {{w|Triple DES}}, an older encryption algorithm which can still be relatively secure when properly used, but they {{w|Electronic codebook|used it improperly}}. It works on 64-bit (8 character) blocks. Assuming that the passwords are stored in plain ASCII, this means that a sequence of 8 characters in a password which starts on a character position which is a multiple of eight is always encrypted to the same result. Therefore, two passwords starting with "12345678" would start with the same block after being encrypted. Furthermore, this means that you can actually get a very good idea of the length of the password since anything with only one block is a password with length between 1 and 8 characters, and having two blocks implies it has between 9 and 16 characters, etc.
 Adobe also stored hints users created for their passwords. That means that an attacker knows not only if the same 8 characters are used for multiple passwords but also has some hints for guessing them. That means that common password portions should be easy to recover and that any user may be "compromised" by someone else using a part of the same password and providing a good hint. As an example, a password having three hints "Big Apple", "Twin Towers" and "If you can make it there" is probably "New York" or a simple variation on that. The weakness here is that no decryption and therefore no hard cracking has to take place, you just group the passwords by their encrypted blocks and try to solve them like a crossword puzzle. These weaknesses have already been used to presumably identify a password used by {{w|Edward Snowden}}, as discussed at [http://7habitsofhighlyeffectivehackers.blogspot.com/2013/11/can-someone-be-targeted-using-adobe.html 7 Habits of Highly Effective Hackers: Can someone be targeted using the Adobe breach?].

@@ Line 12: / Line 12: @@
 Adobe, however, ignored these well-known principles, and instead stored over a hundred million passwords in a reversibly encrypted way, using a terrible choice of encryption methods which exposes a great deal of information about the passwords, and does not involve a salt. This password database was recently obtained by someone and released on the Internet.
-In particular, Adobe used {{w|Triple DES}}, an older encryption algorithm which can still be relatively secure when properly used, but they used it improperly. It works on 64-bit (8 character) blocks. Assuming that the passwords are stored in plain ASCII, this means that a sequence of 8 characters in a password which starts on a character position which is a multiple of eight is always encrypted to the same result. Therefore, two passwords starting with "12345678" would start with the same block after being encrypted. Furthermore, this means that you can actually get a very good idea of the length of the password since anything with only one block is a password with length between 1 and 8 characters, and having two blocks implies it has between 9 and 16 characters, etc.
+In particular, Adobe used {{w|Triple DES}}, an older encryption algorithm which can still be relatively secure when properly used, but they [[wikipedia:Electronic codebook|used it improperly]]. It works on 64-bit (8 character) blocks. Assuming that the passwords are stored in plain ASCII, this means that a sequence of 8 characters in a password which starts on a character position which is a multiple of eight is always encrypted to the same result. Therefore, two passwords starting with "12345678" would start with the same block after being encrypted. Furthermore, this means that you can actually get a very good idea of the length of the password since anything with only one block is a password with length between 1 and 8 characters, and having two blocks implies it has between 9 and 16 characters, etc.
 Adobe also stored hints users created for their passwords. That means that an attacker knows not only if the same 8 characters are used for multiple passwords but also has some hints for guessing them. That means that common password portions should be easy to recover and that any user may be "compromised" by someone else using a part of the same password and providing a good hint. As an example, a password having three hints "Big Apple", "Twin Towers" and "If you can make it there" is probably "New York" or a simple variation on that. The weakness here is that no decryption and therefore no hard cracking has to take place, you just group the passwords by their encrypted blocks and try to solve them like a crossword puzzle. These weaknesses have already been used to presumably identify a password used by {{w|Edward Snowden}}, as discussed at [http://7habitsofhighlyeffectivehackers.blogspot.com/2013/11/can-someone-be-targeted-using-adobe.html 7 Habits of Highly Effective Hackers: Can someone be targeted using the Adobe breach?].

@@ Line 6: / Line 6: @@
 | titletext = It was bound to happen eventually. This data theft will enable almost limitless [xkcd.com/792]-style password reuse attacks in the coming weeks. There's only one group that comes out of this looking smart: Everyone who pirated Photoshop.
 }}
-{{Incomplete}}
 ==Explanation==
 Web sites and other computers that authenticate users via passwords need to be able to know if the user typed in the right password. But storing the password itself on the computer has been known to be unnecessarily risky since the publication of [http://www.neurosecurity.com/articles/security/passwd.pdf Password Security: A Case History] in 1978. In that paper, Robert Morris and Ken Thompson demonstrated the practice of using a slow, cryptographically-secure one-way {{w|hash function}}, so that even if the password file is stolen, it will be very hard to figure out what the passwords are, so long as the passwords themselves are suitably complex. They also pioneered the use of {{w|Salt (cryptography)|a "salt"}} which makes each password hash completely different even if two users use the same password. See [http://security.blogoverflow.com/2011/07/a-tour-of-password-questions-and-answers/ A tour of password questions and answers] for background on salts and suitably slow hash functions.

@@ Line 147: / Line 147: @@
 |purloined
 |<tt>asdfghjk</tt>
-|A reference to the {{w|Edgar Allan Poe}} story "{{w|The Purloined Letter}}", this represents all the keys of the home row, or the keyboard mash password, but with one missing("purloined") letter.
+|A reference to the {{w|Edgar Allan Poe}} story "{{w|The Purloined Letter}}", this represents all the keys of the home row, or the keyboard mash password, but with one missing ("[[:wikt:purloin|purloin]]ed") letter.
 |-
 |<tt>a8ae5745a2b7af7a&nbsp;9dca1d79d4dec6d5</tt>