Re:Fraternal Order of Police Data Dump
by infogulch on Thursday January 28, 2016 @03:07PM
(#10990830)
The key is "Nipper47". Only 8 characters in the standard "short english-ish word starting with a capital letter followed by a couple numbers"-pattern. I'd say it's less that pg_crypto is easy to crack, and more that the key is trivially insecure and easy to brute-force. But sibling is probably right that it was just sitting there.
[ Parent
| on HN ]
Re:Fraternal Order of Police Data Dump
by _asdf_asdf on Thursday January 28, 2016 @04:05PM
(#10991332)
8 chars, including numeric, uppercase and lowercase...
With sufficient GPU resources (being in possession of a working rig, cloud-based or standalone and air-gapped, all powered-up and running operable software) and talent (experience, and familiarity with an existing framework and an established code base), I'm thinking one person could brute force that, in the privacy of their own home, in a trivial amount of time.
Re:Fraternal Order of Police Data Dump
by infogulch on Thursday January 28, 2016 @04:38PM
(#10991575)
> one person could brute force that, in the privacy of their own home, in a trivial amount of time.
Yes. And that's assuming your pattern (26+26+10)^8 ~ 2e14, but the basic character pattern here is 26 * 26^5 * 10^2 ~ 3e10, almost 10000 times weaker. This is an extremely common pattern, most passwords don't follow a uniform distribution of those "numeric, uppercase and lowercase" characters.
Or if nipper is in your dictionary (likely, there's a wikipedia page with that title and there's only a handful of million articles, trivial to add every title, or even every word), then assuming a dictionary of 10 million words, the pattern is 2e710*10, another order of magnitude reduction.