Once Again, Everyone's Favorite Game!
-
Hey everyone, let's once again play the amazing game I call "Guess Where In The Framework They're Mishandling Passwords In Plain Text"
Today's
idiot victimcontestant is PC Plus-- the bonus point program for President's Choice. They're one of the largest grocery retailers in Canada, and the PC point program is one of the most successful in the country. The points are like cash-- you effectively earn 2% back (plus bonus offers).They recently introduced the PC Plus program-- which just added some layers of complexity onto an otherwise simple program. It's one of those "Hey, here's this thing we saw you bought already, so how about we offer you bonus points on it now that you don't need it" bullshit things. It introduced a flash app chock-full of bullshit UI that makes CEOs cum.
So over the past few weeks, I happened to notice a couple things out of the ordinary. First, all the grocery stores suddenly had signs up that said "until further notice, PC points can't be used to buy gift cards". (Yes, you can trade in $20 worth of points for a $20 gift card from the gift card rack-- super nice). Hmm, that's odd. And then I noticed a sign taped to all the cashier stations reminding the cashier "when redeeming any points, shopper must show ID first". In the 10+ years I've been with the program, they've never done that. Huh, I thought-- well, that can only mean there's some rampart (rampant?) fraud going on.
And sure enough, this week they announce "oops security breach and peeps had points stolen our bad. We've gone done and reset all passwords".
They sent around an email with a link to reset the password. Mentioned several times in the email, and on the website, is the word "security". For your security, for security reasons, secure your password, security, security, security.
I mean, sure, it makes sense for a site that just suffered a security breach to be more concerned about security. But maaaaaaaaaaaaaaaaaaaaaaaaaybe they should, I dunno, not pull shit like this:
http://i.imgur.com/EHdrnUd.png
Password length limits. Security!
At least they're letting in special characters (unlike the CREDIT CARD THEY OFFER). So Bb$$$$$$ works as a password. (note: that isn't my password)
-
@Lorne-Kates said in Once Again, Everyone's Favorite Game!:
So Bb$$$$$$ works as a password. (note: that isn't my password)
Or is that what you want us to think?
-
@Lorne-Kates Maybe it's a minim-
-
@RaceProUK
We save on bits so that we can bring you better deals for your PC Points!
-
@RaceProUK said in Once Again, Everyone's Favorite Game!:
@Lorne-Kates Maybe it's a minim-
reading it it appears is is the minimum...... and a maximum..... which really narrows the search space for passwords.
-
@accalia said in Once Again, Everyone's Favorite Game!:
reading it it appears is is the minimum...... and a maximum..... which really narrows the search space for passwords.
Yup.
edit Yup.1111
-
@accalia New policy: to maximise security, all user passwords must be set to "pHE2$XE5umAp". It's a long, random alphanumeric string so completely unhackable.
-
@RaceProUK You outsourced to these strudle-heads?
-
As I've previously posted the newest version of the cable modem/router supplied by certain European providers has these as the Wifi password requirements:
- must include 1 or 2 upper case letters [and no more than 2]
- must include 1 or 2 numbers [and no more than 2]
- must not contain 8 or more lower case characters in a row
-
@Lorne-Kates said in Once Again, Everyone's Favorite Game!:
So Bb$$$$$$ works as a password.
Error: Your password must contain at least one number.
-
@Dragnslcr said in Once Again, Everyone's Favorite Game!:
Error: Your password must contain at least one number.
It does. Hex FTW.
-
@loopback0 said in Once Again, Everyone's Favorite Game!:
As I've previously posted the newest version of the cable modem/router supplied by certain European providers has these as the Wifi password requirements:
- must include 1 or 2 upper case letters [and no more than 2]
- must include 1 or 2 numbers [and no more than 2]
- must not contain 8 or more lower case characters in a row
That sounds less like a robust security model, and more like the rules for one of those EINSTEEN ONLY!!!! logic puzzles everyone's aunt retweets on FaceChat
-
@tufty said in Once Again, Everyone's Favorite Game!:
@Dragnslcr said in Once Again, Everyone's Favorite Game!:
Error: Your password must contain at least one number.
It does. Hex FTW.
Base 36 FTW.
-
@Lorne-Kates said in Once Again, Everyone's Favorite Game!:
@tufty said in Once Again, Everyone's Favorite Game!:
@Dragnslcr said in Once Again, Everyone's Favorite Game!:
Error: Your password must contain at least one number.
It does. Hex FTW.
Base 36 FTW.
BaseASCIIExtended FTW?
-
@accalia said in Once Again, Everyone's Favorite Game!:
@Lorne-Kates said in Once Again, Everyone's Favorite Game!:
@tufty said in Once Again, Everyone's Favorite Game!:
@Dragnslcr said in Once Again, Everyone's Favorite Game!:
Error: Your password must contain at least one number.
It does. Hex FTW.
Base 36 FTW.
BaseASCIIExtended FTW?
I just need to get to first base, TYVM. That is my top priority personal goal for 2017.
Filed under: No joke, that's on the fridge right now. I see it every day I get a cup of water. And I drink 8 cups per day.
-
NEW WTDWTF PASSWORD REQUIREMENTS:
EFFECTIVE APRIL FIRST, PASSWORDS MUST CONTAIN 1 LOWERCASE HEXADECIMAL DIGIT.
PASSWORDS CONTAINING MORE THAN ONE CHARACTER, NON-HEXADECIMAL DIGITS, OR NON-LOWERCASE CHARACTERS ARE FORBIDDEN.
-
@BEN_LUBAR FELLOW HUMAN, I BELIEVE THAT MAY BE INSECURE. FURTHERMORE, HOW CAN WE HUMANS TYPE LOWERCASE CHARACTERS?
-
@accalia said in Once Again, Everyone's Favorite Game!:
reading it it appears is is the minimum...... and a maximum..... which really narrows the search space for passwords.
Can you enter unicode characters? That would expand the search space a bit again.
(Hey, otherwise 8 characters = 8 bytes, so you can store the password, the customer ID [4 bytes should be enough] and the number of pointzzz [again, 4 bytes] in a single SSE register! Efficiency!)
-
@Dragnslcr said in Once Again, Everyone's Favorite Game!:
@Lorne-Kates said in Once Again, Everyone's Favorite Game!:
So Bb$$$$$$ works as a password.
Error: Your password must contain at least one number.
But.. It does; it's got six upper-case 4's..
-
@ben_lubar To prevent dictionary attacks, I recommend you ban the 5000 most common unicode characters from passwords.
I mean, Unicode has more than 128,000 characters and yet everyone keeps using just Latin-1 and some ASCII punctuation. Be more creative.
-
@anonymous234 But typing
元素の結晶、元素の妖怪。
* is hard and I don't wanna!Obviously this isn't my real password.
-
Һᐡոϯ⋴ɼ੨
-
@RaceProUK Without looking it up, and without knowing the kanji, my guess is that this is some kind of idiom, because of the first two kanji followed by
's
on both sides.If I were to make up a meaning for it, therefore, it would be something like, "Sometimes the weather is hot, sometimes the weather is cold."
That is my (un-asked-for) structural analysis of the string provided.
-
@Magus said in Once Again, Everyone's Favorite Game!:
"Sometimes the weather is hot, sometimes the weather is cold."
Not even close :P
-
@RaceProUK Like I said, I was only aiming for the structure; the words are completely wrong :D
-
@Magus Out of interest, do you know what the words are (without using Google Translate)?
-
この投稿は削除されました!
-
@RaceProUK The only characters I can read there translate as
,
and's
-
@RaceProUK said in Once Again, Everyone's Favorite Game!:
@Magus Out of interest, do you know what the words are (without using Google Translate)?
I'M CHEATING!
`Crystal of element, elementary youkai.`or.... possibly a better translation would be
"Element of Crystal, Element of Ghost"
which would be....... i dunno a pokemon typing for a dual type crystal/ghost pokemon?
-
@RaceProUK said in Once Again, Everyone's Favorite Game!:
@Magus said in Once Again, Everyone's Favorite Game!:
"Sometimes the weather is hot, sometimes the weather is cold."
Not even close :P
"Fuck you, give me yens"
-
@ben_lubar said in Once Again, Everyone's Favorite Game!:
APRIL FIRST,
Schnit. That reminds me, I need to email @Remy and get some balls rolling on-- something.
Also, I can't believe it's been nearly a year since I've done any meaningful creative writing.
-
@Lorne-Kates
Well, I mean, once you hit the magic phrase why even bother with new creative writing? Ride that gravy train forever, man!
-
@accalia I love how
of
,'s
, and-ary
are all justの
-
@Magus said in Once Again, Everyone's Favorite Game!:
@accalia I love how
of
,'s
, and-ary
are all justの
it does make translations an utter bitch, and that's before you get to coloquialisms and grammatical differences.
-
@accalia I did spend a lot of time with Google Translate refining the translations, and I'm still not convinced they're 100% correct.
-
@RaceProUK I don't understand that google translate result. 'Gensou' is supposed to be 'element'? I've only ever heard it used as 'illusion'.
And then 'Kesshou' and 'Youkai'? The second was certainly translated right, but either way, this is all very weird and not very meaningful.
-
@Magus said in Once Again, Everyone's Favorite Game!:
'Gensou' is supposed to be 'element'?
Yep, specifically 'chemical element' https://ja.wikipedia.org/wiki/元素. And 'kesshou' is definitely 'crystal' too https://ja.wikipedia.org/wiki/結晶.
Yes, I used Wikipedia to double-check translations
-
@RaceProUK It is a silly language, where two pairs of kanji can be pronounced the same but mean different things. I suppose our language is just as bad in some ways, though.
-
@Magus said in Once Again, Everyone's Favorite Game!:
I suppose our language is just as bad in some ways, though.
True, but at least we don't have three writing systems, all of which are used together, mixed like meat and two veg in a pasty.
-
@RaceProUK Well but to be fair, the other two, the ones they actually invented rather than stealing, make sense. Anyway, turns out
幻想
isGensou
which is slightly different thanGenso
, and there is another pair of kanji with the same pronunciation that translates asgender
, just to confuse everything even more.
-
@Magus said in Once Again, Everyone's Favorite Game!:
@RaceProUK It is a silly language, where two pairs of kanji can be pronounced the same but mean different things. I suppose our language is just as bad in some ways, though.
We eat what we can and can what we can't?
Time flies like an arrow, fruit flies like a banana?
The dove dove? The lead's lead led to the lead leads?
Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo?
-
@izzion said in Once Again, Everyone's Favorite Game!:
@Lorne-Kates
Well, I mean, once you hit the magic phrase why even bother with new creative writing? Ride that gravy train forever, man!Hmmm...
https://www.patreon.com/fuckyougivememoney
http://i.imgur.com/E2IO5jF.png
I think I need more gravycoal for my train.
-
@RaceProUK said in Once Again, Everyone's Favorite Game!:
@Magus Out of interest, do you know what the words are (without using Google Translate)?
I'd wager your name?
-
@Tsaukpaetra Nope :P
(My name would be レースプロイギリス)
-
@RaceProUK You could leave the UK in english letters even.
-
@RaceProUK said in Once Again, Everyone's Favorite Game!:
@Tsaukpaetra Nope :P
(My name would be
レースプロイギリス)ウィカー・ウィカー・スリム・シェーディー )
-
@Lorne-Kates said in Once Again, Everyone's Favorite Game!:
@ben_lubar said in Once Again, Everyone's Favorite Game!:
APRIL FIRST,
Schnit. That reminds me, I need to email @Remy and get some balls rolling on-- something.
Also, I can't believe it's been nearly a year since I've done any meaningful creative writing.
By the way, we're moving off NodeBB to Dwarf Fortress on April 1st.
-
@ben_lubar said in Once Again, Everyone's Favorite Game!:
@Lorne-Kates said in Once Again, Everyone's Favorite Game!:
@ben_lubar said in Once Again, Everyone's Favorite Game!:
APRIL FIRST,
Schnit. That reminds me, I need to email @Remy and get some balls rolling on-- something.
Also, I can't believe it's been nearly a year since I've done any meaningful creative writing.
By the way, we're moving off NodeBB to Dwarf Fortress on April 1st.
I honestly believe you could pull that off in the next month.
-
@Lorne-Kates said in Once Again, Everyone's Favorite Game!:
@ben_lubar said in Once Again, Everyone's Favorite Game!:
@Lorne-Kates said in Once Again, Everyone's Favorite Game!:
@ben_lubar said in Once Again, Everyone's Favorite Game!:
APRIL FIRST,
Schnit. That reminds me, I need to email @Remy and get some balls rolling on-- something.
Also, I can't believe it's been nearly a year since I've done any meaningful creative writing.
By the way, we're moving off NodeBB to Dwarf Fortress on April 1st.
I honestly believe you could pull that off in the next month.
Now I'm imagining a website that's just an SSH session to a shared instance of Dwarf_Fortress.
-
@ben_lubar said in Once Again, Everyone's Favorite Game!:
@Lorne-Kates said in Once Again, Everyone's Favorite Game!:
@ben_lubar said in Once Again, Everyone's Favorite Game!:
@Lorne-Kates said in Once Again, Everyone's Favorite Game!:
@ben_lubar said in Once Again, Everyone's Favorite Game!:
APRIL FIRST,
Schnit. That reminds me, I need to email @Remy and get some balls rolling on-- something.
Also, I can't believe it's been nearly a year since I've done any meaningful creative writing.
By the way, we're moving off NodeBB to Dwarf Fortress on April 1st.
I honestly believe you could pull that off in the next month.
Now I'm imagining a website that's just an SSH session to a shared instance of Dwarf_Fortress.
Twitch Plays Dwarf Fortress!