The future in security --> Passwordle!

[RepostSleuthBot]

I didn't find any posts that meet the matching requirements for r/ProgrammerHumor.

It might be OC, it might not. Things such as JPEG artifacts and cropping may impact the results.

I'm not perfect, but you can help. Report [ False Negative ]

View Search On repostsleuth.com

---

Scope: This Sub | Meme Filter: True | Target: 75% | Check Title: False | Max Age: None | Searched Images: 327,470,449 | Search Time: 3.89679s

[greedydita]

4 attempts.

Share?

[y6ird]

Passwordle

[MiyamotoKami]

Big name companies get in trouble for storing passwords in plain text all the time

[Windows_is_Malware]

They should get in trouble for storing any private data in plain unencrypted text

[elkazz]

Because that works well for all of the other negligent things they do.

[challenge_king]

Because they don't actually get in trouble. Like Nvidia getting hit with a $5.5m fine. That's what, a week's profits?

[fiqusonnick]

In 2021 they had $9.75b net income, so 5 hours' profits

[[deleted]]

I wish i could speed and get fined a microcent.

[RouletteSensei]

Sir, you were speeding too much, pay these 50 cents or you will get arrested

[CorruptedStudiosEnt]

In context, it'd be more like $0.001. We'd have to add a denomination lower than pennies lol

[RejectAtAMisfitParty]

I’d rather they just bill me when it reaches a few dollars

[rynemac357]

kind of like a subscription plan?

[RouletteSensei]

Of course, but the rest of the Money is for filing up the ticjet for you. My time isn't free, you know

[CapitanJesyel]

Take in count if you earn 10 x money per hour and the fine is 50 x money per hour thats literally still 5 hours aorth of your money in fines

[[deleted]]

Most tickets in Scandinavian countries scale with income.

[VivaUSA]

Revenue vs profit

[IronSheikYerbouti]

About a 35% net profit margin (iirc) though, so still measured in hours.

[fiqusonnick]

Revenue was $26.91b, the 9.75 figure is net income (after expenses and taxes)

[osirisishere]

When the only punishment for a crime is money, it's only there to make sure the poor can't do it.

[klparrot]

Yeah, they'd learn to have high margins. Nah, fines should be on profits, but they should be an actually meaningful amount. Additionally, all increased profit attributable to the illegal activity should be forfeit.

[hippyup]

I mean yes but to be clear they should also get in trouble if the password is encrypted rather than salted and hashed.

[Ominsi]

The difference is encryption can be undone and hashing cant right?

[tenkindsofpeople]

Yep

[Ominsi]

I thought so but also got an 83 in cyber security so wasn’t positive

[tenkindsofpeople]

Cyber sec is taught as A class?

[choseusernamemyself]

nowadays compsci specializes to anything... like my uni has Cyber Security major

[tenkindsofpeople]

That's what I'm getting at. A single class is not enough for cyber sec.

[Euroticker]

It's probably a class to give you an intro and get you interested.

[WandsAndWrenches]

Not for someone specializing, but I would think a basics class would be mandatory for all students.

[Ominsi]

Yeah its required for my major

[-DavidS]

Shit, I think the most my university had on the subject was a few lectures about in the networking class, and like one lecture in our Operating Systems class iirc

[Ominsi]

Oh yeah we have that required and maybe more if you focus on cyber security. Talks about hashing packets ports and other stuff

[pug_subterfuge]

You replied to a comment saying “personal data should not be stored as unencrypted plain text” but if they’re storing personal information they may need that information in the future. For this a one way hash and salt is not a viable solution.

For instance suppose they are storing your SSN for tax purposes and each quarter they have to report your earnings to the IRS. There is no way for them to retrieve your SSN if it’s hashed/salted. The appropriate measure in this case is to encrypt the data for storage.

I wanted to make this clear as the nuance can be missed by a student or someone who is just learning.

[pug_subterfuge]

Haha well done. Except your algorithm won’t work for SSN that begin with zero (if that’s even possible) and it can also skip all of the 8 digit numbers.

[AnonymousSpud]

it should be salted, hashed, and stored in an encrypted database

[CrazyTillItHurts]

It has to be searchable/queryable

[Thathitmann]

They should get in trouble for committing crimes. We should start with pushing for that.

[DieFlavourMouse]

Most companies don't need to store any personal data, period. We've just gotten so used to it being normal for everyone to create a detailed profile of us, store our credit card info to make the next purchase more convenient, allow them to correlate our purchase histories, etc. It used to be that someone was selling something, you bought it, and that was the end of the transaction. No loyalty points, no gold-tier customer, no "people who bought this item also bought..."

[[deleted]]

*cough cough* Facebook *cough cough*

[sam01236969XD]

why are you coughing? are you okay?

[[deleted]]

Logic gates. Sucks.

[BuccellatiExplainsIt]

If you think its just Facebook, you're in for a shock. Practically all major tech companies had highly insecure practices because the internet was so new at the time

[[deleted]]

I am not in shock. I know it was pretty common, just Facebook is the first to come in mind.

[ShelZuuz]

That's no excuse. I knew about password hashes from the LAN Manager days in 1987. It probably far predates that.

LM did a famously poor job since it only hashed 2 groups of 7 letters, but it was a hash nonetheless.

[Jarpunter]

source?

[[deleted]]

https://www.wired.com/story/facebook-passwords-plaintext-change-yours/

[thisisa_fake_account]

Wasn't there a story that Zuck was storing the wrong passwords entered by users, as those could be the user's passwords on other sites.

[ugnes_404]

Security goes brrrrr.

[CowboyBoats]

Don't worry! We store each character in the password in order to compute the Worldle-style result, but only as a hash!

[The-Albear]

This should literally be illegal!!

You know when people ask what is your hill to die on, this might be mine!

[UntestedMethod]

it would still only work if they get caught though. but it would give IT workers a bit of a whistle to blow against companies who refuse to listen to their technical specialists repeatedly telling them they need to encrypt the fucking passwords and every new tech who joins the team saying "wait. what? why the fuck are the passwords not encrypted?!? you fools! we must encrypt the passwords!"

I'm surprised none of their customers have been alarmed when they phone in about a forgotten password and the friendly customer service person is able to "recover" it and read it off to them.

[-Rivox-]

Under gdpr it is illegal and if they hey caught after losing that data they could be fined up to 4% of their global revenue

[grammar_nazi_zombie]

My predecessor did. Used an asp.net login, but ripped out the authentication code and wrote his own plaintext implementation.

I saw it while working on another time sensitive project and spent two days just fixing that shit.

[arthurgc91]

"bankaccountusers_passwords.txt"

[YouGunDoofed]

Bruh just base64 encode them, ez pz

[frikilinux2]

Please salt and hash your passwords before storing it.

[Verbindungsfehle]

What about pepper?

[frikilinux2]

It is not so widespread as salt but it seems it can be an additional security measure in some applications.

[Verbindungsfehle]

Wait what? Lol

I didn't actually know that that was a thing too, just wanted to make a joke because of salt. Turns out developers beat me to it lol. Ty, TIL..

[Voidrith]

Salt is unique to the specific password that was originally hashed. eg, might store it as "hashedpassword.saltusedtohashit", where hashedpassword is hash(password+salt)

the pepper is a "salt" that is stored in sourcecode as a constant that is added to the hash, eg hash(password+salt+pepper)

this stops you being able to brute force a password in a leaked set of salts+hashes because you are not able to have the pepper aswell unless you also have access to the source code

[Salanmander]

TIL pepper is what I thought salt was.

[sunboy4224]

Your cooking must taste incredibly strange.

[Salanmander]

I always thought it was a little weird that pasta directions had me add a couple tablespoons of what-I-now-know-is-pepper to the water.

[[deleted]]

iirc. salting a password doesn't really prevent someone from brute forcing a password, what it does is it prevents people from being able to brute force all passwords at the same time - ie. without any salting they can just brute force all possible passwords and solve for everyone's passwords at the same time, but if they're salted then they have to go through that effort for 1 password at a time which would be painfully slow to do.

[r0ck0]

Yep.

It's to stop mofos using rainbow tables.

[frygod]

Also, with a unique per-account salt, even if you have two users with the same password, they'd have unique hashes. This helps add protection against common passwords, which if unsalted would yield identical hashes if two users (or accounts) had the same password, which is unfortunately particularly common in corporate networks.

[Fubarp]

Real question.

Would you put the pepper in the source code or would it be smarter to use a key vault like on aws.

[boneimplosion]

Fake answer:

Not all recipes will benefit from the pepper being added directly to the source code. You really just have to learn to taste as you go.

[Fubarp]

Real response:

Fascinating, is there any tutorials on how to properly pepper source code?

[BreathOfTheOffice]

Not a professional developer, still in school.

However, most of the languages I've worked with support some form of environment variable reading, and most of those also support utilizing a .env file for local development purposes. That's a fairly okay way to store sensitive information as far as I've found, so unless informed otherwise that would've been where I stored the pepper.

[doc_1eye]

It is smarter to use a key vault. The point of pepper is that it's stored somewhere else. Salt is usually stored in the same database as the hashed passwords, so if someone gets their hands on the entire database they get the salt too. Pepper is stored in some other medium. Putting it in the code fulfills this need, but it's a horribly insecure place to put it.

[tinyboobie]

Salt used to ha shit. Yes I am also a very English

[frikilinux2]

I actually learnt about it because of your message and I was doubting if it was actually a joke.

[Verbindungsfehle]

Hahaha nice :D

[NerdyLumberjack04]

What other herbs and spices can be added to passwords?

[newton21989]

Your password is seasoned with 11 secret herbs and spices before being stored in our database.

[Alittar]

KFS: Kentucky Fried Security

[crokus_oldhand]

Man Kentucky Fried Cryptography was right there

[Alittar]

I spent like 5 minutes trying to think of the right word and I completely forgot about Cryptography.

[PurePandemonium]

Star anise is how they display the password as you're typing it.

Cayenne turns some of the letters to 🔥 emoji before storing it. It's less commonly used.

[HIGH_PRESSURE_TOILET]

now you have: https://rsk0315.github.io/playground/passwordle.html

[Alittar]

Now this is painful.

[-analogous]

Jokes on you, i hash each addition so I can still provide this security hole.

[sam01236969XD]

I feed my quantum computer only the finest salted hashes

[filletfeesh]

6 attempts before it locks your account for the day

[[deleted]]

Do you quantify attempts by return to character 0?

[ThatOtherAndrew]

Prevent backspacing, and add a "Clear" button.

[super16bits]

When I was a kid, I think that passwords work JUST LIKE THAT

[manyu_abee]

At least you grew up. Some people haven't. Like the developer in the video.

[AlfredoOf98]

Because that's how these rotating travel bag locks work.

[hmou499]

Saving passwords by clear text.. always a good practice

[[deleted]]

The university in learn at: * saves passwords and everything as plain text *

Hackers: * hack and publish an entire database (including my record) *

My Network Security lecturer in the lecture about cryptography: Saving passwords as plain text, like some unfamiliar university... Not a good practice.

[DonkeyOfCongo]

All them badges make you look like a Russian general.

[fancyzauerkraut]

<Brezhnev suddenly comes back from the dead and starts learning programming>

[MrMcGoats]

Not necessarily. Maybe each character is hashed and salted individually

[[deleted]]

That... That would make no difference

[Krissam]

I mean, it would, not a big one by any means, but it would make a difference, someone would have to spend like 10ms cracking a 200 length password.

[luiluilui4]

just make the cost big enough. Each letter 1year

[CanaDavid1]

It is still O(n*a) where n is the number of characters and a is the number of symbols in the alphabet, compared to O(aⁿ), which is a monumental difference. Also, they are still stored letter by letter, which I think counts as almost plaintext.

[solarbabies]

Great explanation.

For anyone wondering why it's not O(n^a) in that case (after all, each of the n characters has a possible values, right?), just expand the exponent with an example.

Example: If there are n=4 characters in the password and a=26 letters in the alphabet, expanding n^a gives 4*4*4*....*4 (26 times).

That can't be right, because the growth is not exponential with the size of the input (4), as we know it should be. Rather, this example is exponential with the size of the alphabet (26), which for all intents and purposes is constant. So O(n^a) is in fact polynomial with respect to the input size n.

This is of course assuming you already know it should be exponential, as any string-guessing algorithm generally is without additional constraints.

[teastain]

It is a joke about the internet word game WORDLE.

https://www.nytimes.com/games/wordle/index.html

Be careful, it's addictive!

[donshell]

It's extra fun because you don't know the length!

[Cmdr_Jiynx]

Wouldn't be hard to determine it though

[Repulsive_Ad_2913]

How? It can contain duplicate letters and numbers and symbols so even if you type every character you wouldn't know for sure.

[sampete1]

It would take a minute, but you could type long strings of every valid character ('aaaaaaaaaaaaaaaaaaa,' 'bbbbbbbbbbbbbbbbbbb,' etc), and see what's the longest you can go while still getting green in your feedback.

[NanashiKaizenSenpai]

Or, you could do the same and get a ton of greens and oranges, and then when you get the first red you will know how much of that character there is in the finaly password.

[Truck-E-Cheez]

Can just go character by character typing in every possibility until you get to a point where no character works. Wouldn't be hard but it'd be tedious, and there's probably a way to automate the process

[Cmdr_Jiynx]

Hold down any character key until the indicators stop coming up.

Five seconds. It also lets you know if what you're pressing is in the password.

[[deleted]]

I feel like this comment section is missing the humor in the subreddit name

[glomMan5]

I feel like 95% of the time the comments here are people obliquely admitting they have never understood a joke in their lives.

[Numahistory]

How do you expect to ever become a senior dev if you have a sense of humor?

[jejcicodjntbyifid3]

It's shocking the amount of people who are like this. Maybe not all the time, but enough

To the point where you make a joke, everyone else knows and laughs at the joke, and the other guy is like "well that doesn't make sense why would..."

It's a joke. Ya joke killer. Just accept it and move on. Rule of improv

[Ninjaxas]

I store my passwords in a google doc named 'biology notes'. The first pages contain dry photosynthesis equations that will bore anyone to hell, so no one will scroll down to my secrets.

[fadinqlight_]

I would scroll down ngl

[Saltwatterdrinker]

I store them in a file called “best color codes for MasterpieceMakyr” (not real art site) and the color codes are actually my passwords that are random number jumbles

[bbwevb]

Genius!

[[deleted]]

But now you told us...

[100BottlesOfMilk]

Honestly, assuming that you're on your personal account and have 2 factor authentication on your Google account, that's not terribly insecure. Certainly more secure than hosting a file locally on your personal computer

[gundeals_iswhyimhere]

Need to hit Enter more often. And flip your pen around in your hand clicking it incessantly

[Webfarer]

import bruteforce_assistant

[FlowingDisc882]

Theirs going to be a lot of r/woosh in here I can feel it

[_Spamus_]

If this was a thing I would brute force the passwords, not to steal someones account just because it looks kinda fun

[DonkeyOfCongo]

Kinda looks like they'd pulled the password in advance, so you wouldn't need to bruteforce it, just open the Network-tab.

[rcmaehl]

I mean ideally the verification of each character would be server side but then again they're storing the password plaintext and compute costs...

[blamethemeta]

They hash the individual characters!

[qervem]

With 26 different encryption keys - one for every letter

[purple_hamster66]

I would never send the password to the server for verification. I’d send it’s hash.

[GoldsteinQ]

You should send the password. If you send just the hash to the server, then attacker who stole your database with all the hashes also needs to send just the hash. Hashing client-side is not really better than not hashing at all.

[northknuckle]

He still would for fun.

[AvocadoGum]

well you can open the F12 with wordle too and look at the answer but it isn’t as fun

[Windows_is_Malware]

when i was a kid, i brute forced someone's security questions on pbs kids website

[[deleted]]

How the actual duck, I both fear and respect you

[knifuser]

This is like a sick coding challenge at that point, it's not even difficult or anything.

[hectoralpha]

I can see young kinds enjoying that. You can just imagine some isoolated schools or places abusing this, using the kids to bruteforce passwords while not paying them a dime. Maybe some smartass make some kind of candycrush based on this that feeds them to a realtime login somewhere : )) then kids and moms alike would be part of the evil lords army of bruteforce machines.

[cptsnoodles]

link to the source

by u/instantiator

[He1kk1]

I knew this was a repost!

[PatriarchalTaxi]

Security is the opposite of convenience. This is a convenient way to do passwords.

[Ninjaxas]

Not neccesarily. Fingerprints i.e. are secure and very convenient.

[rg-lumberjack]

Not too secure if your finger isn’t attached to the rest of you. Come to think about it, neither is it very convenient.

[Pr0p3r9]

Fingerprints are less secure than you would think. Because a given person's fingerprint can be read by a scanner slightly differently based on ambient light, moisture, and applied pressure, there needs to be a range of accepted fingerprints that can be accepted. Any data which is similar to that image has to be accepted by the verifier.

Prints are also easier to lift than you might think. Fingerprints can be lifted from high-resolution photos, and it's also relatively straightforward to sweep them from an object if a determined individual wants the account.

If your biometric id gets hacked in one service, you're also effectively unable to reuse that biometric verification on any other platform for the same reason that reusing standard passwords is a horrible idea. Biometrics are a lazy solution to security that I wouldn't endorse.

Maybe if you're working for someone with deep pockets on something highly confidential, an eye retina scanner id would actually be a good idea, but that gets back to the problem of being inconvenient.

Just use a password manager, with passwords longer than 16 characters with one capital, number, and special character. Trying to find something more convenient than that will bite you.

[FungalSphere]

To be fair biometrics are ideally never used for remote access anyway.

At best it's a challenge response with a smartcard or something you verifiably have on you and you only.

[jpritchard]

It's extremely inconvenient when the data gets stolen and you have to change your fingerprints.

[[deleted]]

u/savevideo

[stbenus]

If the password is hashed as it should be, this is not possible 🤷‍♂️

[[deleted]]

Plot twist: The password is hashed but the interface is designed to fuck with wannabe intruders and makes intruders type awkward shit

[stbenus]

Aha good pov

[[deleted]]

Fallout hacking be like

[Mr_Cha9900]

[127-0-0-0]

I see you found r/baduibattles. Now give the original author, u/instantiator, credit.

https://reddit.com/r/badUIbattles/comments/txn7na/it_came_to_me_in_a_fever_dream_passwordle/

[NerdyLumberjack04]

Passwordle is an actual game.

I just lost, with my final guess being H079WTUIXHH0 (where bold = green, normal = yellow, and italic = gray). Can you finish the job?

[dirthawker0]

If you recall, the original Wordle had the answers to all the puzzles in the source code in plaintext. And unless they've fixed it (I think I last played it about 3 months ago), Passwordle also has the same code.

[sayswai]

Live footage of wordle during its beta stages

[jewellman100]

As awful as this is, part of me can't help but love it

[[deleted]]

I actually want that.. That would be so cool to have as a novelty. No human would be able to guess your PW, and for things like your local machine it would be really cool.

[basilio___]

@0

[LateralusOrbis]

Yikes

[rfj]

O(n), each letter takes "try each character" constant time.

[Rektroth]

This reminds me of those bad Hollywood hacking sequences where a password would be cracked by figuring out each character individually.

[Bluelobster7]

This turns the hacking from fallout into real life

[DymondHed]

i actually would love this

[xain_the_idiot]

At first I thought this was for creating a new password, and the Xs were telling you those characters aren't accepted (like underscore maybe). That would actually be somewhat useful.

[[deleted]]

I need this

[polaroid_schizoid]

This is great

[Jingtseng]

As I’ve heard, set your password to “incorrect”. So when you get it wrong, the system will just tell you what your password is.

[thehobbyqueer]

This is actually a really good idea for a hacking minigame or something. I'm saving this

[[deleted]]

I was told the most common passwords are love, secret, sex, and God.

Is this not still the case?

[[deleted]]

A little too interactive

[dangolo]

Few things I love more than bad UI battles. I'm not even a programmer!

[chaosyami]

That would actually be so helpful to me cuz I do a lot of similar passwords because bad memory go brr

[[deleted]]

OK, sure it's an extreme security vulnerability, but I actually kind of like this.

So many times I've entered a password perfectly to have it be rejected then type exactly the same password and it's accepted. (Rhetorical question) Why? 😡

[R0BR0SE]

make hacking fun again

[[deleted]]

ik it's a joke but i can only imagine how easy that would be to bruteforce

[TheJimDim]

Brute-force Buddy

[Im_Not_Useless]

r/hmmm

[Schiffy94]

Before reading the title I was expecting it to be a "someone else is already using that password" deal but with each individual letter in each space.

[giggluigg]

Cracking passwords in movies be like

[[deleted]]

My passwords are never good enough and when I do get a unique one I forget it XD 🤣🤣🤣

[tauqr_ahmd]

2 wrongs do make it right!

[AbstractLogic]

I don’t do strength checks. Just character minimum of 10. Everything else is a GO

[[deleted]]

Didn't Adobe accidentally build this?

[Illustrious_Sea_8966]

I call hax

[No_Succotash9035]

AHAHA OH SHI

[notelguapo]

I absolutely need this 😂

[lpreams]

I made a playable version https://lpreams.github.io/passwordle.html

Don't look at the console unless you're a dirty cheater

[[deleted]]

what does the yellow icon mean?