Thanks.

Given this, I think the journalist over-simplified the situation in their story and that the "F12" jokes are unjustified. Recognizing there's a disclosure of private information here requires a lot more technical knowledge beyond the ability to view the HTML source.

The governor is still wrong for pursuing this and what the newspaper did was right, given that they disclosed it to the responsible parties and didn't publish until the problem site was taken down.

I feel like the F12 jokes are fine, since they don't even match the Governor's exaggerated rhetoric about "hacking". Pasting the base64 into one of many online decoders isn't much of an extra step. The Governor kept calling it a complicated 8 step process or something similar to that.

Base64 can be done by hand with two tables: one splitting every character in three times two bits and one that takes four pairs of bits and looks it up in the ascii table. Done.

It's hard to call this encryption.

It can also be done using a few small books, mapping strings of 4 base 64 characters into 3 ASCII characters. With 100 printable characters (according to Python), and assuming you can get 96 per page (4 columns of 24; possible with clever layout), that would fill about 50 books.

Okay, maybe that's not very efficient.

Each pair of Base 64 characters contains a single ASCII character, plus some change. That would take three lookup tables of about 1000 entries each; given that the “change” letters could use character ranges, that would take 3 or 4 sheets of A4 (or A3, if you wanted large print).

I've always imagined that somewhere out there is a dude who has spent time to teach himself how to decode/encode base64 in his head.

Best I've done so far is to recognize that "eyJ" means I'm probably looking at JSON, since `{"` followed by any letter will always begin with that.

  > It's hard to call this encryption.

It's a lie to call this encryption. It is encoding, not encryption.