Passwordle (opens in new tab)

Winners never quit. And quitters never win.

But those who never win AND never quit are idiots.

Is it?

6 guesses and I have 14 hex digits (56 bits) of the hash, along with knowing the population counts for all the numbers. This is enough to run a password cracker and determine the plaintext if it's a readily guessed password.

Sure, it breaks conventional use of rainbow tables, etc, but...

edit: Eh, 14 characters. OK, that's pretty resistant to anything other than debugging.

I ended up crossposting it to the few security rooms I'm in for quick laughs

But for what it's worth, this also serves as a great initial CTF-type introduction to how debuggers work in web browsers.

As someone that works at an authentication API company, there are _dozens_ of us who found this hilarious.

> Yet I also laughed out loud when I got how conventionally impossible it is. Maybe give it a whirl with https://sha256algorithm.com/? haha

It's not impossible. I hear Bruce Schneier got the correct hash on the first try.

https://www.schneierfacts.com/

(Sorry for the very HN:ish post, but I feel it's somewhat in the spirit of this story)

Well, it made me laugh. Thanks, that's what the Internet is for! (Namely, amusing content about the technicalities of the Internet.)

You can easily guess the right sha256 just using random strings and overlapping correct characters and then you can run a dictionary attack on it, or a brute force one if it's not too long.

I laughed. It’s excellent, and great fit for the crowd here.

I laughed so hard

Oh wow! You have a lot of friends!... (unironic self deprecating voice)

An Absurdle exists[1], but instead of giving no hints it is adversarial, e.g. changing the secret word to dodge your guesses.

[1] https://qntm.org/files/absurdle/absurdle.html

Given that speed/timing is important, and the rules are designed to impede your progress, how about calling it Hurdle?

Absurdle already exists: https://qntm.org/files/absurdle/absurdle.html ;)

They should name it something else as absurdle is already taken.

https://qntm.org/files/absurdle/absurdle.html

Timing of SHA-256 reveals only the length of the input.

I don’t get it? Why would the answer be *******?

Yeah same. From the source code, the answer is a random 14-character string, generated on load:

    function randomPassword() {
        let letters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
        let digits = '0123456789';
        let punctuation = '!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~';
        let s = letters.repeat(7) + digits.repeat(4) + punctuation.repeat(3);
        let length = 14;
        let res = Array.from({length}, (() => s[randomInt(s.length)])).join('');
        debugger; // どうぞ
        return res;
    }

Literally my first guess.

I tried in these classics in vain:

- hunter2

- password

- correcthorsebatterystaple

Part of me wishes the author just took common passwords from rockyou.txt so that they're at least guessable. Though random really does add to the absurdity.

I did not know about the debugger statement until I read your comment: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... . Thank you.

Would the type of people amused by this have that weakness though?

It's hosted on Github Pages which is just static file serving. And thanks to CORS restrictions I don't think you could phone home.

Unless there's a workaround I'm not thinking of.

Well damn, I’ll have to change Hunter2 everywhere now.

is a password very useful without any other identifier though?

It could work theoretically (the password contains around 90 bits, and from each row you can glean, dunno, some 64 bits of info (64 characters that can be yellow, gray or green, so 101 bits, but there are constraints on that - very unlikely that all characters are gray, for example)).

In practice, I don't think it's computationally feasible. You can't keep all 2^90 = 10^27 possible solutions around in memory. Bitcoin does 200 EH/s, so 2e20 hashes/s. So the entire bitcoin mining network would have to work for 2 months (5e6 seconds) or so - don't see how you can meaningfully reduce the work (it would indicate a flaw in SHA256, no?).

If you can casually write an algorithm to break a modern cryptographic hash in 10 guesses... I would like to know. Because then I have to decide if I want to be a very good friend of you, once you get rich, or if I want to stay as far away from you as possible once the state intelligence agencies come after you.

If passwordle had a list of all possible solutions like wordle does, this would be doable.

My first guess was "friend", a la the Doors of Durin.

http://tolkiengateway.net/wiki/Doors_of_Durin

It's a clone of the popular wordle game where you have to guess a word, except here, you have to guess a password but instead of telling you which characters of the password are correct it tells you which characters of the corresponding SHA-256 hash are, which makes this pretty much impossible to solve as the whole point of a hash are that small changes in the input (such as a different character in the password) results in big changes in the hash.

It's Wordle but it hashes your guess before applying hints.

Gee, I'm so glad somebody posted this so that I can cheat on a game that is not competitive and that I'm playing voluntarily and that has no bragging rights because of how niche it is.

Yes, but the point is to show that each password produces a sha256 not correlated to the sha256 of other passwords. That people actually tried to guess this way shows that not everyone is aware of the sha256's purpose.

Not defined for me

Me too but this can never be sold right

Same here! I love the absurdity of this one given the nature of cryptographic hash functions.

Why would you do that xD - I'd have explained it to her instead, doing what you did I'm not sure I'd be happy about as wifey ...

hint: it needs to be 14 characters

0/10 literally unplayable.

Should've been Argon2id

That's a consequence of certain characters not reappearing in the hash as compared to the hash of the actual password.

This would become more apparent if this traded in sha512s instead.

well if you manage to break sha256, sure you do ;)