Hacker News Reader

Comment by ythn | Hacker News Reader

I too am interested to see how long it takes assuming the attacker knows the generator ruleset (which he will have had to work out previously from two plaintext passwords of mine).

Still, I don't think it's that easy to figure out the ruleset of a good password generator if you make it obscure enough.

For example:

Amazon: NovemberAlphaies12#

Facebook: KiloFoxtrototto16&

What's the ruleset?

Answer: Phoenic alphabet of last + first letter of domain + italian number representing total letters in domain backwards + integer sum of the digits on either side of each digit in the Italian number + symbol representing sum of the digits of the previously calculated integer repeated until reduced to one digit.

Seems like way too much work for an attacker to try to figure out.

View on HN

Frankly, the phonetics were trivial. So it's really...

Amazon: ies12# Facebook: otto16&

"Otto" made me think 8, and that led me to "sei" (I read stuff upside down when reading to my kids, so I flip letter orders easily). It didn't take long to figure out those were the length of the site. So now we're down to....

Amazon: 12# Facebook: 16&

These follow a pattern (digit digit symbol), so even if I didn't notice that the symbols were only those above digits There are about 2000 possible choices. Or 11 bits of entropy.

I didn't understand your number scheme, but I probably don't need to.

Yup that wasn't hard at all. Also, security researchers / consultants / ___hats solve these kinds of puzzles all the time for their work and hobby. Friends I have in that business are insanely good at this sort of thing. Because apparently people always think they're so clever. One told me on multiple cases doing whitehat security consulting they studied the desk+office of the sysadmin for a bit (no post-its), pull some Sherlock Holmes magic (I don't know really) and guessed the password in 5-10 tries (no I didn't quite believe it either, but otoh this guy really doesn't like bragging nor had any reason to lie about).

Oh and if I understand the number scheme correctly:

> integer sum of the digits on either side of each digit in the Italian number

that means, when the number is "otto", meaning 8, the "digits on either side" are 7 and 9, which when you sum them, equal 7 + 9 = (8 - 1) + (8 + 1) = 8 + 8 = 16, so it's really a complicated way of saying "double that number" ... :-)

> Seems like way too much work for an attacker to try to figure out.

I dunno, seems like way more work to come up with, maintain, and actually use the generator. Seems easier to just click a bunch in my vault to generate and copy, although I guess you're protected from vault-theft?

Given your example, I had already figured out all the way up to ies/otto are probably foreign numbers (more specifically, otto looks like 8 and 16 looks like double of 8) before even seeing that you just gave the answer away.

Give me some time with him and a $5 wrench an I can "steal" his "password vault" - https://xkcd.com/538/

What do you mean by "integer sum of the digits on either side of each digit in the Italian number"? Your italian number is a word, not a sequence of digits. It looks to me like that number is really just the number of letters in the domain multiplied by 2. And the rest of that password scheme is actually rather trivial to deduce (assuming you can recognize italian numbers).

It's a word that represents a series of digits. "Otto" represents 8, tredici represents 13, etc

Yes, I know that Otto is Italian for 8. But even if I convert the italian word to the number, it doesn't make sense, because "8" doesn't have digits on either side of the digit so there's nothing to sum up.

7 and 9 are on either side of 8, and the sum is 16.

Of course (x-1)+(x+1) = 2x

Seems like kind of a lot of work to go through every time you want to log onto a site too, compared to just copying and pasting from your vault. (Or using a browser plugin, depending on your personal convenience/security trade-off preference.)

Reply on news.ycombinator.com