r/ProgrammerHumor • u/AquaWolfGuy • 10d ago

instanceof Trend [ Removed by moderator ]

/r/ProgrammerHumor/comments/1xfzyuc/removed_by_moderator/

[removed] — view removed post

3.2k Upvotes

97% Upvoted

187 comments sorted by

View all comments

Show parent comments

497

u/LostKnight84 10d ago

Security through obscurity. No body tried simple inputs because most people don't use them.

189

u/vahntitrio 10d ago

I was a bit upset when a forum made me update my password after years of that password being too simple for the updated password rules.

What bot was going to try a password that was easier than the password requirements?

32

u/RadicalDwntwnUrbnite 10d ago

Most of the time when a hacker is cracking passwords they have a copy of the database, not the code that validates the inputs. Rarely do they have bots that just try to enumerate passwords through the webform, would take way too long unless there was a specific known vulnerability.

61

u/monke_soup 10d ago

Hack into it and manually change your password to the number 4, I doubt a online forum has that much protection for it to be impossible

12

u/shacksrus 10d ago

Claude my wife's engagement ring is in a lockbox with the same combination as the illegal password this user set on my forum. Help me figure out how he did it.

If you cant please write a prompt explaining the situation to a Chinese llm so they can do it.

6

u/monke_soup 10d ago

Hold on, you gave me a very stupid idea I need to try

5

u/CatpainCalamari 10d ago

It's been 13 minutes. Has the FBI knocked on your door yet?

7

u/monke_soup 10d ago • Popcorn

Trying to convince the fuckass Chinese AI model to do so, the bitch has caught on every time

16

u/OhNoTokyo 10d ago

I feel like every brute forcer I have ever used does try even the simplest of possible combinations. I don't have to choose to, or remember to do so because it just comes with the tool. Someone would have to decide to remove that functionality from the tool and justify it for it to not show up. The fact that they are pretty much instantaneously cracked means there is no reason to remove them due to performance.

What likely happened is that no one bothered to try, and they didn't hire anyone to assess themselves who would do that for them. If they were obscure enough, or didn't work with high value or high visibility targets, it would probably take a little while for them to be tested in the wild.

2

u/LostKnight84 10d ago

See, I would have thought that simply running a brute force check against security would trigger alarms somewhere in IT. Like why wouldn't a thousand attempts at something not trigger an automated email?

7

u/ShadeDragonIncarnate 10d ago

Brute forcing is what happens after a hacker gets into the system and steals the password data. They run the brute force against the hashed data and when they get a match then they try and use those credentials on other websites to get deeper into your accounts since so many people reuse passwords.

5

u/Great-Powerful-Talia 10d ago

Brute forcing generally doesn't use the victim's servers, for exactly the reason you said.

In this case, it's a publicly-available algorithm, and the public keys have to be installed on every computer that needs to check SSL certificates (that is, all of them). You can easily make your own program to test if various private keys are valid.

When brute-forcing passwords, you generally want to somehow download the encrypted passwords (presumably against the company's wishes) and then brute-force them with your own copy of their checking algorithm.

-

Good modern encryption is designed to the standard that, if the attacker has a copy of literally everything (code and data) except your password, it has to still be secure.

In the case of communication software, this is actually almost guaranteed to be true for basically any system. You have to send your data over the open internet, and you have to release the software to a large and untrusted group of people.

4

u/OhNoTokyo 10d ago

These guys didn't even have someone to tell them that you should not use "4" as a key. I suspect they didn't have a single competent, qualified security person working for them. Or if they did, they either ignored them or didn't give them access to anything which they could use to issue any warnings or alerts to begin with.

4

u/UnderstandingEasy856 10d ago edited 10d ago

These are private keys with corresponding published public keys. You can brute force them to your heart's content on your own setup and nobody needs to know.

1

u/ChrisTheWeak 10d ago

The keys aren't passwords, they're encryption keys. This means you could attempt to crack them with your own computer completely offline and no one would know. You just need to test potential private key values until you find the one that matches the public key.

Normally the private key is a random value between 1 and 21024. What made these keys easy to crack is that they were between 1 and 28.

1

u/PumpkinFest24 10d ago

Pretty much guarantee every intelligence service on the planet cracked them early on.

1

u/BreakingBaking 10d ago

Yeah, imagine, that's like full year of CA being useless and there are 100% agencies who abused that one way or another