Hacker News Reader

Comment by TheJoeMan | Hacker News Reader

I must say, if I was writing a password cracker, I probably would not think to actually start at "1".

Of course not, we start at negative zero.

https://en.wikipedia.org/wiki/Signed_zero

When I walk into a bar, I always ask the bartender for negative zero beers, just to check the place out, before placing my actual order.

I have not yet been accused of arson, but it's only a matter of time.

Learning about the concept of “negative zero” in school stuck with me. It was one of those lessons where the professor had us bang our heads against one’s complement to understand the shortcomings and introduced two’s complement like Moses coming down with the stone tablets.

I don't know, when I run a password cracker, I always start with a brute force pass of very short passwords. Doing so adds a negligible amount of time to the crack, and its surprising how many short passwords you'll find in systems that permit them.

I was a little surprised when a well-known password cracker managed to pop a bunch of passwords set by a sysadmin at a place I used to work at, who had left under something of a cloud.

I wouldn't have got them if I hadn't set it to start at three characters, on a hunch.

Cameron, if you're out there, I hope you're making less of an arse of it and not still using "CAM" as a password for everything.

You should start at "" or 0, not "1".

First time I pointed John the Ripper to a password file it immediately started beeping like crazy. Turns out default password was no password, and 70% of the accounts were unused. Those happy quaint 90s...

And space / newline / carriage return / null byre should be in your charsets, even if the people who use those belong in prison.

As I understood it, any private key up to N can be cracked in √Ν steps. I don't know what threshold they used, but they probably ran the scan for small private keys.

I don't think that's true. Got a source?

It's called the baby-step giant-step algorithm, and it's referred in the report thread to Mozilla:

"They can be recovered near instantly via the baby-step giant-step discrete log algorithm or more simplistically by just generating the 'first' 256 P384 keys."

Oh, I thought you meant "private key up to N bits", not "private key up to the exact value N". In that case, sure, but for non-eMudhra-issued keys BSGS's more relevant complexity figure is O(2^keybits). Unless you've a quantum computer on you, in which case I'm told it's easy-peasy :)

Security through incredulity

"Certainly no one is that lazy/stupid/ironic..."

Welp, there goes that password

Reply on news.ycombinator.com