Subnostr

nostr:npub1kdyzl44h6mhyl4djtf20w0t7avsy09umshq2k2czjf62ps774phqcd2hnf if nothing has changed that means the dogman in your car is still real

Replying to

woodland creature

nostr:npub1j5l9mm3k5rwafe8c89x5uyfrlly26nkkv69frje6jjf85yaeqcwqfvwxv4 i think i've ripped all my music cds at this point. can't bring myself to get rid of them so they just take up space

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub106dam65ww9ztdqj26xvh08dyuc7lj7nmkrtrujwsmyq2n6g3r33saq3m89 nostr:npub1j5l9mm3k5rwafe8c89x5uyfrlly26nkkv69frje6jjf85yaeqcwqfvwxv4 I've deluded myself into thinking my old game CDs (DVDs?) might be worth something someday

Replying to

d

my position is the NSA can crack just about anything if they want to devote their resources to it. 1 billion tries a second? pfft they'll run it in parallel in a warehouse of servers the size of rhode island if they're serious

but in order to do that at all, they have to have a copy, yes? they're not doing that remotely, or even with remote access, because any sane system would notice and halt a spike in authentication requests beyond known peak + some margin. so you're likely pwned for a whole bunch of reasons and the password isn't going to save you

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr talking about systems with access control usually isn't relevant when talking about password cracking. Only really interesting when they have the hash on a local disk.

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub1psx7zml4neu6v03fe6pqcdp4lvcf444mfswy4rlfz28s8jwtzjtqrxgvsy nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr 80 is roughly the number of valid letters/digits out of the ASCII table

Replying to

you are fat (fact)

Based and legalpilled!

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub1pnpez7cn4h04pxg07dmmklzyz7u7fm0w2ddrw220qh785rq3m42ql452zw nostr:npub1j5l9mm3k5rwafe8c89x5uyfrlly26nkkv69frje6jjf85yaeqcwqfvwxv4 see if you want the CDs it's based. If you just want the CDs for the media it's cringe.

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr wow that was 1 trillion. Morning brain

Fe₂🦀₃⋅H₂🦀 2y ago

Yes pleroma that is a valid url please do be clicking

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr 80 being my morning brains attempt at trying to remember the ASCII table

Replying to

d

No, I see it, and I'm trying to tell you that the fact that a password is known to exist does not compromise it absent *a lot* of knowledge about the specific nature of the password.

I can generate every 30 character combination of alphanumeric+common symbol passwords trivially, does that mean a 30 character random password is easy to crack?

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr >I can generate every 30 character combination of alphanumeric+common symbol passwords trivially

I actually dont think you can do that.

Replying to

d

How are they going to do that without a copy of your data on their server? You're already pwned at that point.

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr I honestly don't know how I would verify a valid sentence that has never been spoken. That seems gruelingly difficult. It is very likely that everything I've ever written is some sentence level permutation or recombination of something that someone else wrote.

Replying to

Fe₂🦀₃⋅H₂🦀

nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr I feel pretty confident that the NSA has a list of all known valid English sentences (with permutations) and they could probably run it in a few minutes. I don't have proof of this but I suspect a table like that would fit within a terabyte

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr ok so apparently you can't see my post to enzymical. The other hand of that was:

I don't think the average person is creative enough to NOT pick one of the known sentences so it would be a very bad security policy if you're talking about a commercial product.

Frankly though I'm not sure I could pick a sentence that's never existed if I was really trying.

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub1psx7zml4neu6v03fe6pqcdp4lvcf444mfswy4rlfz28s8jwtzjtqrxgvsy nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr oh

Replying to

d

Just because a sentence is known to exist doesn't mean the attacker can reasonably pick it from the ~10^5000 options. Any information you give an attacker about the nature of a password bounds the space, regardless of the nature of the key.

The point is, unless the attacker *knows* they're looking for english passphrases that are very well defined -- which they don't because nobody has a security policy specifying such a thing -- the fact that a password is a phrase in english does not weaken it at all.

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr I feel pretty confident that the NSA has a list of all known valid English sentences (with permutations) and they could probably run it in a few minutes. I don't have proof of this but I suspect a table like that would fit within a terabyte

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub1kdyzl44h6mhyl4djtf20w0t7avsy09umshq2k2czjf62ps774phqcd2hnf nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr if if helps, steam has a new feature where it can automatically download the game from your other computer on LAN if it's logged onto the same steam account. I was very confused why I was getting gigabit download speeds until I saw that.

Replying to

d

I don't think so. If you consider words as symbols, sure, some of them only have a few possibilities. But some have tens of thousands of possibilities. How many nouns are there in the English language? How many verbs?

And the assumption that the sentence will be strictly perfect English is an extremely poor one to begin with.

And the attacker doesn't have any knowledge that they should be using such a rule set. They just know it's a string of characters. In the case of my example, it's 63 characters. They don't even know how long it is.

It would be stupid for a password policy to be "You have to use a password that strictly conforms to the rules of written English and is between 30 and 40 characters long" but nobody is suggesting doing that, and that's not what the anti-phrase claim itself makes about the security of a phrase.

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr see my response to enzymical. If the sentence is mutated in some weird way, you're probably right, but if the sentence has ever been spoken by any human in history it will be trivial to find it with a modern computer.

I don't think the average person is creative enough to NOT pick one of those so it would be a very bad security policy if you're talking about a commercial product.

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub1psx7zml4neu6v03fe6pqcdp4lvcf444mfswy4rlfz28s8jwtzjtqrxgvsy nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr yes, I do a similar thing when I can't use a password manager (such as full disk encryption). I permutate the words mispell them in ways that are easy to remember but are not natural mistakes humans make.

On the other hand, if you took a valid sentence with valid words, the chances that the sentence appeared somewhere on the internet at some point since its creation are very very high and there are many people with copies of every sentence that's ever existed online (NSA, google, ect)

Replying to

d

I've never understood this claim but I've seen it quite a bit

like, maybe this could be an extremely specific attack on an individual known for some phrase, but otherwise, you're not doing a successful dictionary attack on a long password just because it's a sentence in more or less proper english

even if you claim there's some loss of randomness due to the patterns of letters and spaces -- which is true -- that's more than offset by how easy it is to remember and type out an *extremely long password*

"and so mary said, bring me a cup of orange juice with my toast"

good fucking luck pal

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub15fkerqqyp9mlh7n8xd6d5k9s27etuvaarvnp2vqed83dw9c603pqs5j9gr I think with the restrictions of valid grammar, the number or meaningful English sentences is actually very small compared to random character combinations even with many words. Even if there are billions of them, that's no problem for hashcat.

Replying to

Nigbot

i need mo money fo dem programz :soyjak_Canada_point:

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub1m90awajauydqt40t4ez5q6jxcjea3ur78x5w3m96j6ap8h0duksqztmdfy nostr:npub1d2nzz6g5leutwsrtwaau5ntt6540vpaxr6kgj3v2pksf7t8q6m8sm3n2yu nostr:npub16l059pzkq8eyk5kfvwgahyjhqm2zta8h8tpwe8ulf6xjgdgangsqkr3ke7 🎺 🎻 begone

Replying to 6947188e...

nostr:npub1y6tk68elxfcrz8yx5kf32agav67hwz4rt2ff22f8rl98yxh7uxhsx69wl9 nostr:npub1d2nzz6g5leutwsrtwaau5ntt6540vpaxr6kgj3v2pksf7t8q6m8sm3n2yu microwave buzzing noises as it spins

Fe₂🦀₃⋅H₂🦀 2y ago

nostr:npub16l059pzkq8eyk5kfvwgahyjhqm2zta8h8tpwe8ulf6xjgdgangsqkr3ke7 nostr:npub1d2nzz6g5leutwsrtwaau5ntt6540vpaxr6kgj3v2pksf7t8q6m8sm3n2yu

you can hear it

we can all hear it

Fe₂🦀₃⋅H₂🦀 2y ago

Is the microwave in the room with us right now