Hacker News Reader

Comment by infogulch | Hacker News Reader

The key is "Nipper47". Only 8 characters in the standard "short english-ish word starting with a capital letter followed by a couple numbers"-pattern. I'd say it's less that pg_crypto is easy to crack, and more that the key is trivially insecure and easy to brute-force. But sibling is probably right that it was just sitting there.

View on HN

8 chars, including numeric, uppercase and lowercase...

With sufficient GPU resources (being in possession of a working rig, cloud-based or standalone and air-gapped, all powered-up and running operable software) and talent (experience, and familiarity with an existing framework and an established code base), I'm thinking one person could brute force that, in the privacy of their own home, in a trivial amount of time.

> one person could brute force that, in the privacy of their own home, in a trivial amount of time.

Yes. And that's assuming your pattern (26+26+10)^8 ~ 2e14, but the basic character pattern here is 26 * 26^5 * 10^2 ~ 3e10, almost 10000 times weaker. This is an extremely common pattern, most passwords don't follow a uniform distribution of those "numeric, uppercase and lowercase" characters.

Or if nipper is in your dictionary (likely, there's a wikipedia page with that title and there's only a handful of million articles, trivial to add every title, or even every word), then assuming a dictionary of 10 million words, the pattern is 2e710*10, another order of magnitude reduction.

Reply on news.ycombinator.com