The Password Game | Hacker News Reader

The Password Game

neal.fun

1,413 pointskretaceous486 comments

I'm stuck at "iatetomatoesyesterday0265Z#521juneVpepsiVIIxngxcaboutAg[moon emojis]italy2020Bf7+" trying to solve the chess notation puzzle.

I especially laughed at the rule "must include today's Worldle" and I'm happy with my solution including every emoji for "must include the current phase of the moon as an emoji."

(HackerNews doesn't seem to display emoji. My solution is to paste every moon phase emoji.)

Excited to see what's next after figuring out the best move in this Chess puzzle.

This reminds me of trying to manually construct an Autogram like below. This one is a quote someone else made. I tried to do it myself and it is so hard because the counts keep changing as you write out other counts!

Only the fool would take trouble to verify that his sentence was composed of ten a's, three b's, four c's, four d's, forty-six e's, sixteen f's, four g's, thirteen h's, fifteen i's, two k's, nine l's, four m's, twenty-five n's, twenty-four o's, five p's, sixteen r's, forty-one s's, thirty-seven t's, ten u's, eight v's, eight w's, four x's, eleven y's, twenty-seven commas, twenty-three apostrophes, seven hyphens and, last but not least, a single !

https://en.wikipedia.org/wiki/Autogram

You could potentially paste the chess notation into chatgpt and ask for the next move! It's not perfect but it'd be better than me at it at least

ChatGPT is really and at chess. I'd just paste it in one of the online chess engines.

There are apps that detect the positions from an image, and run a local version of stockfish to get the best move

https://chessvision.ai/

Also got stuck at the chess one with "551A!mayShellVIIVr8gecmaboutAuSingaporeBxe6"

You may need the + at the end of your notation if you're putting the king in check.

Yup, I had to come here to figure out that the + was missing in mine! TIL!

I think the chess one is bugged. I've entered every possible move for the board I received and none of them worked.

Edit: figured it out

It worked for me, but I had to include `Rxb6+` for the capture and the check.

Isn't Q×h6+ the best move for white, since there is a mate in 1 after that move. Am I missing something?

The game is selected at random each time you play, so depending on which you get the solution will differ.

Enter without ×.

Can you please tell me? I've been stuck on it for an hour and a half.... I really need help ;-;

tl;dr

K = King

Q = Queen

B = Bishop

R = Rook

N = Knight

Pawns have no letter

You append a "+" to the end when it is a check move

You append a "#" to the end when it's a checkmate move

You add an "x" when your move eats another piece

Examples

- Moving a rook to g6: Rg6

- Moving a queen to d7 which eats a piece: Qxd7

- Moving a bishop to a3 which checks the opponents king: Ba3+

- Moving a pawn to e5: e5

- Moving a queen to h7 which eats a piece and checks the king: Qxh7+

- Moving a pawn to f4 which checkmates the king: f4#

I learned more from your concise post than I ever have from articles, Wikipedia, etc.

For Real. I finally understood chess notation.

Thanks for this. What if two rooks can both get to e5, how do you disambiguate?

Using the column they are on, or the row if they are both on the same column. For example Rac8 moves a rook from a8 to c8, R1d2 moves it from d1 to d2.

There are few more.

Rae1 - rook a to e1. if two rooks on the first line can move to e1. R4d4 - if two rooks on the 4th line can go to d4. Ngxh2# - the knight from g captures on h2 with checkmate.

Nd2e4 - In a rare case that there are 3 knights that can go to a single square

Pawn captures are denoted as exd5 (pawn on the line e captures a pawn on d5) even if there is only one pawn that can make a capture.

Just adding promotion

- d8N# pawn moves and promotes to a knight resulting in checkmate (it can happen)

I couldn't get it to accept a move which involved the knight jumping over a hostile piece. It was definitely the best move (I fed it into stockfish and got the same response). I refreshed the page to get a new puzzle and got a new street view as well. (╯°□°）╯︵ ┻━┻

Edit: Oooohhh, I think I forgot to add a + for check!

How tell me.

Also got stuck on the chess game - had to peruse the webpacked source code for the array of solutions...

Italy? Interesting that it is giving different locations. I got Qatar.

It's random

I got Colombia, and C is a roman numeral so I think I'm stuck. edit: nevermind I can just make it lowercase.

I got colombia to, you just have to make the letter lowercase!

I had to use stockfish

Brutal

Haha, yeah I used Chess.com analysis and it gave me a clearly best sequence of moves (three to checkmate) but it didn't take the first move from white that it asked for. :( I saw many other struggle with this one too. Anyway, I gave up here and seeing some of the subsequent steps I doubt I'll reach the end anyway!

I got the chess one pretty easily but I'm stuck on "The elements in your password must have atomic numbers that add up to 200". I haven't found a way to satisfy both this and "The roman numerals in your password should multiply to 35" simultaneously. Iodine (I) and Uranium (U) have high atomic numbers which blow out way higher than 200 and I haven't found a way to avoid them.

Edit: OK, just realised that it's case sensitive. So I can use a lower case "u" to avoid it being interpreted as an element.

I had a chess move that's Rg8+ but Rg has an atomic number of 111...

You wanna start the chess move with Q...

But the best move in the chess puzzle I got requires moving the rook.

Many of the puzzles are different for each player, I personally had Rf8+

Yeah, I got an Rf8+ and between that and the roman numerals, didn't know how to get down to 200. Then I tried to move the egg to a different spot and the chicken died.

Technically impossible since queens cannot materialize out of thin air, except in crazyhouse.

Also Rg1+ is a rather pretty attraction/clearance sacrifice/double check/mate-in-2.

The chess puzzle is different for everyone...

Qxg7+. Chess subreddit has a counter of days without a puzzle that starts with a queen sacrifice.

XXXV also works for the roman numerals.

XXXV * I = 35. Po (from Poland), V, and I add up to 160, so you need to add Zr.

Seems to accept Qxh6+ as well as the other answer given here, I guess both work!

I'm too stuck at the chess move with XXXVJanuarypepsi@3pe4g99tractHechile

The worldle one I found kind of annoying because now I have to go play another game to keep going, one I don't find all that interesting.

You can just search for the answer to save having to do that

Now it seems progress has become literally impossible because the chess move + the captcha includes digits that add up to more than 25. I guess having to restart is intended to be part of the game, or is this a bug?

You can cycle the captcha.

You can reroll the captcha

It doesn't seem to understand how wordle does timezones

You can fail at wordle and get the correct answer revealed at the end.

This is indeed what ended up transpiring, but only after trying really hard to figure it out all the while thinking the meanings of gold and green were the opposite of eachother.

I take puzzles way too seriously, and I suck at word puzzles.

Made me stop playing, because I block wordle shares on every social media channel.

I got stuck at the chess move too A591@juneShellVIIVec6pmtractFeNigeria2020

"Only the fool would take trouble to verify that his sentence was composed of ten a's, three b's, four c's, four d's, forty-six e's, sixteen f's, four g's, thirteen h's, fifteen i's, two k's, nine l's, four m's, twenty-five n's, twenty-four o's, five p's, sixteen r's, forty-one s's, thirty-seven t's, ten u's, eight v's, eight w's, four x's, eleven y's, twenty-seven commas, twenty-three apostrophes, seven hyphens and, last but not least, a single !"

nice job! autograms are strangely pleasing.

Python:

  >>> sentence = """Only the fool would take trouble to verify that his sentence was composed of ten a's, three b's, four c's, four d's, forty-six e's, sixteen f's, four g's, thirteen h's, fifteen i's, two k's, nine l's, four m's, twenty-five n's, twenty-four o's, five p's, sixteen r's, forty-one s's, thirty-seven t's, ten u's, eight v's, eight w's, four x's, eleven y's, twenty-seven commas, twenty-three apostrophes, seven hyphens and, last but not least, a single !"""
  >>> import collections
  >>> sorted(collections.Counter(sentence.lower()).items())
  [(' ', 73), ('!', 1), ("'", 23), (',', 27), ('-', 7), ('a', 10), ('b', 3), ('c', 4), ('d', 4), ('e', 46), ('f', 16), ('g', 4), ('h', 13), ('i', 15), ('k', 2), ('l', 9), ('m', 4), ('n', 25), ('o', 24), ('p', 5), ('r', 16), ('s', 41), ('t', 37), ('u', 10), ('v', 8), ('w', 8), ('x', 4), ('y', 11)]

Checks out.

A warning to future players: I got to rule 16 and was given an egg named paul that I had to keep safe. Then on rule 18 a fire (of emojis) broke out in my password, killing paul and ending the game. Dont be like me, keep Paul safe.

same here... Paul burnt to death an I lost :(

Thirding it. I'm guessing the move is to back up the password, move Paul to the first/last character, and delete everything to save him.

Update: this strat works. But then don't immediately overfeed him.

Later on there is a rule where you have to feed Paul bugs, and I lost by feeding him too much

I, too, overfed Paul :(

for me, he starved while I was looking for a youtube video and I am not strong enough to play through this again, even if I loved the game

Exactly same here. I gave him too much food while I searched and returned to a dead paul :(

Yep. Went to find a YT video and came back to find Paul was dead. Couldn't bring myself to start again.

I was immensely disappointed when I googled "13 minute 39 second video" and then the Youtube video titled "13 minute 39 second countdown" was in fact 13 minutes and 54 seconds long.

I Gave up on the youtube video.

Honestly though, this is still better than some of the "secure password" prompts I've encountered in life.

Same

Paul needs 3 bugs every minute. Overfeeding him looses the game

Don't be like me, don't overfeed Paul

Also, Paul must not be overfed

^^I tried leaving him a bunch of worms so I could search for a youtube video and I was betrayed, greedy Paul.

Me too :<

Found it out the hard way :(

You can keep Paul safe by adding something like a lot of = before the egg and continuously delete the appearing fires and at some point the fire will be gone

How'd you solve it (rule 16)?

I'm completely stuck on it... I've tried every single combination that came to mind :/

The position seems to be randomized each time you play it, so their solution isn't going to be of much use for you

Also make sure to add the x for captures and the + for check and things like that

You can cheat by entering the board state into a site like https://nextchessmove.com/

try chessvision.ai, it allows you to scan the page and get the next best move.

I came up with "invalid notation" a bit, but on my first go I had something like "Bh5" and I needed "Bh5+"

If you put the opposing king in check you need to put the +

Not even surrounding Paul with water emojis could stop the fire.

Nice idea, he died from fire on my first run as well. Maybe I'll try again in the evening.

Paul was slain :(

"SiP@pepsin.VII@Vmay8y63f-2aboutcolombiaKh6"

Decent password 10/10

For me the fire didn't break out until Rule 20

I killed Paul when trying to get the atomic numbers to equal 200. My plan was to add "H" until the rule was satisfied. Then, I thought I accidentally went past it, so I started holding backspace. I went too far.

hahaha yes exactly the same happened to me too

"PAUL WAS OVERFED"

OH NO!!

Me too :(

that's when i gave up - it took the game from solving puzzles to fast-reaction video gaming.

For anyone else who was struggling to make the leap year work with all the other math: 0 is a leap year.

For anyone else struggling with how to make the country name work with roman numerals or element names, you can lowercase the country name then it doesn't count as a roman numeral nor element.

If your chess move is illegal, make sure you're also notating the effect of the move (Nxe6 for N captures on e6, not just Ne6. Ne6+ if it's a check. Ne6# if it's mate.)

Spaces are also allowed so feel free to break up parts of the password to separate things and prevent them from interfering with each other.

Use XXXV as the roman numeral. Easiest to work with since only V (23) is an element.

Reroll your color if its hex has any numbers in it. You'll thank me later.

I made it to the final challenge (password must contain the current time) and it became extremely difficult because the current time, the length of the password itself, and a pesky 9 that was in my youtube URL were just too much to add up to 25 (even though I tried to overlap things, like 3:383 to cover 3:38 current time as well as 383 prime password length). I would've needed to somehow reupload a video that didn't have any digits in it (or at least one that had a lower digit like 1 or 2) or wait until it was 10:00 pm or something.

> For anyone else struggling with how to make the country name work with roman numerals or element names, you can lowercase the country name then it doesn't count as a roman numeral nor element.

Unfortunately, "country name" and "all the vowels in your password must be bold" are fundamentally incompatible, since it doesn't recognize country names unless they have unbolded vowels.

EDIT: Gah. I tried every Unicode "bold" variant I found, before finding that the password field had in fact become a rich text field and allowed actual "bold".

I had no problems getting 'canada' recognized with the a's bolded.

Rich text passwords, an amazing innovation.

I cycled through _so_ many hex colors and youtube videos. I found that searching the length in the youtube search bar led to plenty options. I even chose to exclude 'x' which was _so_ dumb as I had to switch my XXXV to a V and VII, making life much harder for myself.

Ultimately I finally got a password with length 211, including the current time, that fit all of the rules!

[spoiler] the final step has you re-type your password to "confirm" it, in an impossible amount of time [/spoiler]. What a frustrating ending!!!

Also ended up with exactly 211, maybe the easiest choice. Sad at the ending.

Other hints:

* The eyedropper is a good way to get the hex quickly.

* On Youtube search the time you need and then scroll until you load a metric ton of videos then Cmd+F for the time (e.g. 28:22) since the times are searchable text on screen.

Same length as mine

I changed my phone's clock to 1:00 and it worked for me

I lost Paul to a fire (3 different water emojis didn't put it out :(). Then I didn't feel like typing in every single possible chess move until it was happy, so I gave up redoing it.

You can just delete the fire.

"Congratulations! You have sucessfully chosen a password in 113 characters."

This was a horrific abomination, and delightfully evil.

My solution (which includes some spoilers, even though each game has somewhat different rules): https://social.joshtriplett.org/@josh/posts/AX8ypcJYS8eSFLUX...

Did you actually manage to re-type that?

Copy (before answering the "is this your final password" question) and paste seemed to work fine on everything except the chicken emoji, so I just had to paste and then manually enter and italicize a chicken and two bugs within the time limit.

This was fun!

It reminds me of "Password Purgatory" that Troy Hunt (of "Have I Been Pwned" fame) built. It sends real scammers to a real-looking site that basically makes them play this game until they give up and go away.

https://www.troyhunt.com/building-password-purgatory-with-cl...

This isn’t really significantly more irritating than half the password “rules” forced on me by major companies who ought to know better.

“A special character…” Okay, how about: “

“No, not THAT special!! (Shh, we are worried about a SQL injection attack… in your password… which we dont even know how to escape)”

Let the many implications sink in for a minute.)

It doesn't necessarily mean that they don't know how to escape special characters, it just might mean that they're employing a defence in depth approach.

I once had to deal with an site that would be fine with a ' in the password when setting it, but would throw a mysterious error every time you tried to log in.

For about 2 years I reset my password many times, always to the same one and that would also log me in. I just figured the site was broken for me but this worked and contacting support is rarely helpful for stuff like this so whatever, until it suddenly dawned on me the ' might be the "problem".

Managed to make it almost all the way to the end! Note that "is this your final password?" is not the last challenge, despite it being the last thing on the lists other people have posted. Afterward you're asked to retype your password which is almost impossible to do, given that it's in various sizes (with any zeroes at font size zero) and partially in windings.

I recommend copy/pasting before you get there. It doesn't let you copy once that final resubmit form appears.

This is the last saved copy of mine (from ~5 steps before the end; also, yc doesn't capture the various fonts, text sizes, and emojis):

xngxcaboutjuneshell0000XXXV*I54malaysia0Nd3+Gd d4dbc1170

I'm impressed you were able to not get tangled up by the youtube/captcha/color hex/roman numeral mess! The youtube one is what screwed me over and over out of all my attempts

"00:00 / <minutes>:<seconds>" youtube

Google that, including the quotes, replace the minutes and seconds with your given time, then look through the results and find a URL which fits the password criteria.

Every result should be a video with that duration. If it isn't, check your useragent. I noticed some weirdness with that.

Hmm, I tried googling "00:00 / 17:02" youtube and none of the results were the right duration on both Chrome and Firefox. Any ideas?

Not sure. It's working for me

The Chrome Inspector Color Picker does not return the right hex code! You have to go into the properties to get the right value.

How do you solve the time issue - does it lock in the time at the moment you complete that rule, or do you need to keep updating the password with the new time? Also, is the time UTC or time zoned?

You need to keep updating the password. It's time zoned. Basically you have to plan ahead as to what time you want your password to be submitted at and get every other rule satisfied before that time.

In my case it was 8:20 and I had a sum of 15 so I fixed my password in the next 20ish minutes and set the target time to 9:01 at the earliest and spun up an auto hotkey script to paste the food for Paul every 20ish seconds (in reality I think it eats faster than that)

yeah, just lost at that point too, didn't have my password copy pasted anywhere :(

I guess I should have been wary of a confirm password phase. i even wrote a tiny auto hotkey script to keep feeding that stupid chicken for 40 minutes while I waited for time to tick from 8:20 (I didn't have the password ready yet) to 9:01...

Neal has outdone himself yet again. I had it until the roman numerals and adding upto 25 ones but lost my cool when it said it must include today's wordle answer.

Screaming and crying.

I gave up on rule 18: The elements in your password must have atomic numbers that add up to 200.

I gave up when I needed to represent the best chess move in algebraic notation, but I couldn't because the text from the captcha I had to solve earlier contained an illegal move... rage

You can regen the captcha, I stopped at that too because I couldn't be bothered.

It works if you put the chess move before the captcha

https://nextchessmove.com/

I wonder if the password becomes invalid if you leave the tab open for 24 hours...

Won't say too many spoilers but after a certain rule part of your password can starve to death if you don't feed it enough. Ask me how I know :(

Mmm, I overfed a certain part of the password.

I failed when it wanted me to add emoji. It's against my religion.

List of countries in geoguessr: AlbaniaAndorraArgentinaAustraliaAustriaBangladeshBelgiumBhutanBoliviaBotswanaBrazilBulgariaCambodiaCanadaChileColombiaCroatiaCzechiaDenmarkDominicanRepublicEcuadorEstoniaFinlandFranceGermanyGhanaGreeceGuatemalaHungaryIcelandIndonesiaIrelandIsraelItalyJapanJordanKenyaKyrgyzstanLatviaLithuaniaLuxembourgMalaysiaMexicoMongoliaMontenegroNetherlandsNewZealandNigeriaNorthMacedoniaNorwayPeruPhilippinesPolandPortugalRomaniaRussiaSenegalSerbiaSingaporeSlovakiaSouthAfricaSouthKoreaSpainSriLankaSwedenSwitzerlandTaiwanThailandTurkeyUnitedStatesUgandaUkraineUnitedArabEmiratesUnitedKingdomUruguayEgyptPakistanChinaDominicanRepublicIndiaVietnamBermudaPuertoRicoRunionFaroeIslandsGreenland

from https://geoguessr.fandom.com/wiki/Countries_on_Geoguessr

(unfortunately the only way to use this I can find is to put it in the password and then delete it bit by bit)

I don’t think this is the source. My answer was Liberia. I was able to spot a .LR domain on a street sign ad.

Then I accidentally lost all progress by clicking the chess notation link and when I got back to the geo guessing it was a small forested area with nowhere to walk to so I gave up :(

it's from fandom.com, so might be out of date. I think the general strategy would work if you had the right list of countries - although if you're determined to just cheat your way past this step, probably better to just look at the source and get coordinates as someone else has suggested.

I inspected page source and found the coordinates in the embed, then looked it up via that. Mine was the middle of a field in Brazil.

The country in my attempt was Venezuela. I was placed in a chapel (?) and was able to find a plaque which helped me to identify the country.

I got El Salvador which is not is the list.

How do you satisfy the chemical elements constrain if you get country starting with 'Au'? It's 79 plus VII (23+53+53) and V (23) (from roman numerals part), while the sum should be 200

I believe you can lower case the A so it won't register as an element. Also, there's more than one way to get 35 as a multiplication problem...

I had to look at the source to find the possible options. In 906d40b.js starting at line 3471 (could change in the future) is an array of possible values. You can search for the embed url of the iframe to get the country name.

It looks like

  [
    {
      title: 'Australia',
      link: 'https://www.google.com/maps/@-25.350684,131.0463223,3a,7...',
      embed: 'https://www.google.com/maps/embed?pb=!4v1686332510022!6m8!1m7...'
    },
    {
      title: 'Austria',
      link: 'url',
      embed: 'url'
    },
    ...
  ]

I'm about to send an email asking the site manager to remove this before any PHB types take it seriously....yes those types exist and yes they would see this as inspirational...God help us all...

At least it has a great UI

This would be great to use on my sites so users choose stronger passwords.

Is there an api planned, or is it open source?

please try playing the game, it's not about this :)

didn’t think I needed the /s

I apologise for being an idiot. I will buy a new sarcasm detector shortly.

An api that's $1/request unless you have a prime number of requests, then it's free.

Needs to have the actual password obscured, e.g. with asterisks.

In fact, also the length should be obscured, show nothing, as is the way in Unix password prompts!

This turns into a mildly frustrating riddle as some of the challenges are random (captcha, Street View, chess challenge) and end up making it impossible to continue. Got my number added up from the captcha and the best chess move came to be Qh6 (I would need a chess master to disagree with me) so I'm already busted on the add to 25 and then it tells me the "Qh6" notation is illegal (Ok, I was never good with chess notation but I'm pretty sure that says Queen to H6...)

Yeah I think there's a bug with the chess notation, I also had it tell me Rh3 was illegal notation. Interestingly Rf3 is not illegal notation but an illegal move for me.

I thought I had this issue, but it turned out I had to remember the "+" at the end, when I put my opponent in check

THANK YOU! I was stuck not knowing the "+". In my case it was a check mate.

I also had to figure out how to enter chess notation. As it turns out you have to add "x" after the piece if you want to capture or "+" suffix for check.

Ah. That might be it... Anyhow after staring at that chess challenge I was sure to get a mate in two moves with the Qh6 but the captcha filled with numbers plus the add to 25 left me with only 3 to spare... So no way am I winning this game.

You can refresh the captcha. I had to a couple of times.

For the chess solution I ended up putting a breakpoint in the Javascript. To each their own.

I ended up refreshing the captcha until I got one with only one number, in order to get around that kind of issue.

The "two digit periodic table symbol" is also arbitrary - it has to be initial caps! Then if you refresh the page, the random stuff resets, so I gave up at that point with !marchpepsidn26n2555VIIVabout where "dn26n" is random captcha.

If it included a check Qh6+ could have been the answer?

Yeah, I got Croatia in the Geoguessr section, which means I can't possibly multiply roman numerals to 35, since C is 100.

You can use a lowercase c, and it won't count as a roman numeral.

You can regenerate the captcha at any time.

Yeah, I'm stuck on the chess part too. Figured out how to put black in check, figured out the notation, including the +, but it doesn't agree that's the best move. Put the positions into a chess engine... it agrees with me with what the best move is.

Fun game though, I laughed out loud at the Wordle requirement.

Reminds me of BOFH :-) https://www.theregister.com/offbeat/bofh/ https://en.wikipedia.org/wiki/Bastard_Operator_From_Hell

The classic stories brought a smile to my face for a long time.

Amazing. I've always wanted a similar game card readers:

Remove your card before the clerk gets annoyed at you. The screen is flashes various messages like "PLEASE REMOVE YOUR CARD after the TRANSACTION IS COMPLETE". Push the card too hard and the reader falls off the table. Pull at an angle or too slow and it drags the reader.

Among Us?

Very nice game! Little trick for the moon-phase, just past all emojis.

Unfortunately got a dead-end yesterday when reaching the rule (18?) about the sum of the periodic elements equating to 200, with the chess move being Nh8 (containing Nh, no 113) and the wordle solution being (tract, containing Ra, no 81), making it impossible to go below 201.

I would have liked in that case a way to request another chess puzzle, just like it is possible to do for the captcha.

you can write tract in lower case

It’s case-insensitive.

The elements are not case-sensitive "ra" is not detected as an element, but "Ra" is.

I am stuck on the chess one because my captcha included text with "xe8" which could be read as a (albeit confusing) algebraic notation.

So I give this game a 6/10 for bugginess. Would not recommend the preorder.

edit - after reading some of the comments, I realized I could change my destiny by resetting the captcha

You can refresh the captcha

You can also enter more than one chess move. only one has to be right.

There is no bug, it only cares the correct answer is present. It's okay if other substrings are also valid chess notation, that won't prevent you from passing the rule if you include the correct one

the wordle question is bugged because it doesn't handle time zones the same way that wordle does - so only works in some places

How does Wordle handle time zones?

Like the others said, that is not a bug, you can add other chess moves. One bug however is that bold characters break other answers.

The chess one is much easier with my favorite Chrome extension, chessvision.ai https://chrome.google.com/webstore/detail/chessvisionai-ches...

Just make sure to add captures/check/etc (Examples from wavemode on this thread: Nxe6 for N captures on e6, not just Ne6. Ne6+ if it's a check. Ne6# if it's mate.)

Reminds me of Password Purgatory. A site made by Troy Hunt (the haveibeenpwned guy) which looks like a signup page (actually seems to have an api) but the password requirements get more ridiculous each time. The link is then sent to spammers who bug him about his blog. https://passwordpurgatory.com/get-hell?kvKey=510aa555-e482-4...

That's a shame, I reached an impossible situation. The best chess move is Re5+ which includes the letters Re which is the element Rhenium with atomic number 75. However since the roman numerals need to multiply to 35 then the only valid solution is having VII and V (XXXV for 35 is not recognized for some reason), and V is Vanadium with atomic number 23 and I is Iodine with 53. That already leaves me with 227, above the 200 threshold for one of the rules.

You should be able to do XXXV and I to get 35, I think it needs two roman numerals to multiply (that worked for me at least)

Got to the youtube video length url, but then I overfed Paul. Hilarious and frustrating at the same time :D.

I found the video, it's by the United Nations, only for Paul to starve. What did the UN ever do for us, eh?

doh, of course the video length is randomized.

I thought I was being so clever by filling up the password field with food, so I could buy lots of time to search YouTube. I didn't realise Paul could be overfed :'(

How did you find my company's login page?

I got to rule 35, I think I was one away from victory, best time to play this is probably around 10:00-2:00 so that you can keep low numbers and it doesn't mess up rule 5. I gave up and decided to slay Paul myself. Paul is the bane of my existence.

VIIJuneVShell65$bw6n6aboutHecroatia0000 so far. Croatia was extraordinarily hard to guess. Currently stuck on the chess game, if anyone has generic advice on how to not suck at chess.

Fun bonus: it can't seem to figure out what's going on with the knight. Using "K", "N", or "S" for knight all get me "invalid notation" warnings. I'm having a lot of fun.

New update: got the chess answer! It will accept "N" for my Knight iff I make stupid moves with it. Moving my knight to take a bishop is "invalid notation", but apparently putting it in the middle of nowhere to be captured by a rook is the best possible move.

Final update: Paul died in a fire. :I

oh man I got really lucky and was prompted with a picture of Italy. I got it right on my first try. I didn't realize the country images rotated!

The notation for capturing should be something like "Nxe6." I'm guessing the mistake you're making is just doing "Ne6"

Also, add "+" at the end if you're putting the king in check.

Managed to find a youtube video of the exact length (rule 25 - in my case it was 18m05, which I found with https://www.youtube.com/watch?v=cLVClhMyJgY after a search for "17 minutes 50 seconds"), but that then screwed up my Roman numerals.

However it did seem to get past that rule to rule 26 (while still complaining about the roman numerals):

"A sacrifice must be made. Pick 2 letters that you will no longer be able to use."

I chose poorly, I thought it was for questions going forward, and I knocked out the "S", needed (amongst other things) for all the sponsors.

C'est la vie I guess.

Your password must be at least 5 characters.

Your password must include a number.

Your password must include an uppercase letter.

Your password must include a special character.

The digits in your password must add up to 25.

Your password must include a month of the year.

Your password must include a roman numeral.

Your password must include one of our sponsors:

The roman numerals in your password should multiply to 35.

Your password must include this CAPTCHA:

Your password must include today's Wordle answer.

Your password must include a two letter symbol from the periodic table.

Your password must include the current phase of the moon as an emoji.

Your password must include the name of this country.

Your password must include a leap year.

Your password must include the best move in algebraic chess notation. (picture of chess puzzle)

← This is my chicken Paul. He hasn't hatched yet, please put him in your password and keep him safe.

The elements in your password must have atomic numbers that add up to 200.

All the vowels in your password must be bolded.

Oh no! Your password is on fire. Quick, put it out!

Your password is not strong enough

Your password must contain one of the following affirmations:

Paul has hatched! Please don't forget to feed him, he eats three every minute.

A sacrifice must be made. Pick 2 letters that you will no longer be able to use.

Your password must contain twice as many italic characters as bold.

At least 30% of your password must be in the Wingdings font.

Your password must include this color in hex.

All roman numerals must be in Times New Roman.

The font size of every digit must be equal to its square.

Every instance of the same letter must have a different font size.

Your password must include the length of your password.

The length of your password must be a prime number.

Uhhh let's skip this one.

Your password must include the current time.

Is this your final password?

I would find it hilarious if someone would come up with a password generator that generates passwords that would pass this game.

Should be pretty easy, since you can check the generated password against all the criteria. Making it fast might be difficult though

I don't think it's easy. Verification is much easier than generating correct solutions for this.

Looking at the JS, these rules use RNG such that you can have an inconsistent or impossible password. E.g. if the only youtube video URLs that work with your duration have roman numerals that multiply above 35 in it you are hard stuck. Your youtube URL can also hard stuck your atomic number summation to 200 if it happens to contain enough elements that adds above 200. Your color hex can hard stuck your 25 sum, etc. The code does not try to generate working passwords given all the rules, it simply adds checks and randomly generates the requirement per rule.

You'd have to have the RNG rules to align well in order to win i.e. youtube video with no roman numerals or numbers or elements, captcha with no numbers or roman numerals or elements, to minimize conflict.

Well, you could always upload your own YouTube video...

Make the generator use Pupetter and your YT credentials to upload an empty mp4 video of the given length.

I uploaded a video quick just to pass that step since the length was hard to find. The generated video ID was a bunch of Roman numerals so I was totally fucked.

Re-upload until you get a good ID

I wonder if something like quickcheck could be used to randomly generate characters which pass the criteria. I don't know how it would handle Paul though...

For a given video length, there will be some youtube video urls without roman numerals, and with low digit sum, and atomic number.

I first search this on Google

"0:00 / mm:ss" site:youtube.com

Where mm:ss is the desired length. Then I used some Javascript to scrape the results, finding only youtube urls without roman numbers, and print them out sorted by digit sum and atomic number

I've done it a few times, never had a situation where there was no suitable url

As for the color hex, if it's not suitable, you can regenerate it

I threw this into ChatGPT and got a lot of the way there in one shot. Then had to go back and add in some stuff like the wordle answer and captchas…

I almost overturned my table when Paul didn't survive the fire. No way I'll play again!

I played again and fcking Paul overate

You forgot rule 24: Your password must include the URL of a x minute and y second long youtube video

Love it :D

Reminds me of something I built a few years ago, to answer spammers who keep contacting me with their offers of "services": https://cingen.net/moostik/signup/

The most insistent one tried 31 times (the rules are conflicting and it's impossible to satisfy the answer). Special attention was given to the security questions, but somehow spammers keep picking the simplest one.

neal.fun and ciechanow.ski are vying for the number 1 spot on my list of HN auto-upvote submission hosts

Amazing !

Died after the URL, it was too much to recalculate the atomic numbers and keep track of Paul. Maybe this chicken was the most unfair part of this game, the random captcha and country make it impossible to retry easily (maybe the time frame for feeding could be slowed down); but loved everything else, really ingenious.

cshell-may-p4pde-about-bulgaria-00-991-Qg2+-XXXV-bFmN- -iamloved-https://www.youtube.com/watch?v=gWJaxlYRSc0

Same here, I retried at least ten times if, sometimes stumbling over a copy paste error that got Paul killed, but keeping the chicken alive was the choke point for me. Perhaps it would be allowed to encode part of the url?

Also wouldn't url's with roman numbers in it fail the entire thing as 35 only can be obtained by multiplying 5 and 7? Ah right, or 35, true that but still same issue.

I got a (seemingly?) impossible problem:

- roman numerals must multiply to 35

- my chess move is: Rf7+

- Atomic numbers of elements must add up to 200

So I need V, VII and Rf7+ in there but then the atomic numbers are way past 200 already.

Same boat. I tried doing some parenthetical math (X-III)(III+II) but it doesn't work.

Well I is for Iodine,which has 53 as its atomic number, so this definitely wouldn't work anyways. XXXV is the way around this.

Just use XXXV? No need to do 5 * 7

it parses the V in XXXV as an element group

But that's not a problem because that leaves you with only V and R which add to 98, so you only need to add some others to get it up to 200.

I have a similar problem -- the Google Maps country I got is China, and the C is already 100 -- how do multiply it "down" to 35? Can I do parenthetical math similar to what a sibling comment suggested?

Update: I found the answer in another comment -- I can make the c lowercase! Thank you HN!

Sadly, this is way less annoying than many sites because it doesn’t require submitting the form and losing half the form fields in between attempts.

I gave up after having to include a leap year (Rule 15), I don't know if this is a spoiler but I ended up with January99Pepsi?XXXVggd7maboutZrJapan (there was an emoji in there for the current moon phase but HN stripped it out)

Looking at the code it should be possible to get a lot further, in theory. Wonder how Paul is doing!

The country is randomized; mine was Albania (that was NOT easy to figure out!)

I saw a hot spring and got a very lucky guess, I can imagine there are a lot of hard ones in there yeah!

Google a street name.

If it lands on a street it lets you roam around, but others only let you look and zoom around, they are harder if not impossible for mere mortals.

My country was El Salvador. I would not have guessed it (I kept trying equatorial countries). I had to reverse engineer the URL encoding of the embedded map.

Spoiler: There is !1d and !2d, followed by coordinates.

Mine gave me a place a Qatar, which doesn't even seem to have real photos but 3D renders instead: https://goo.gl/maps/YynAc2JSfKJzeAwWA

I had albania which was easy -- there was a nearby poster with some writing on, and a short ddg led to albanian sites.

2000 was a leap year and it doesn’t screw with your numeric total too badly :)

8 AD was a leap year.

so where 0 and 4 ;)

Debatable - the concept of leap years was invented before 0 AD/CE but I'm not aware of any reason to believe that particular year (which certainly wasn't called 0 AD at the time, it was possibly the Roman year 753) was considered to be one.

0 isn't a year anyway, 1AD is preceded by 1BC.

Wikipedia has some information on leap years around this time: https://en.wikipedia.org/wiki/Julian_calendar#Leap_year_erro...

Interesting that there seem to be a large number of scholars who would accept either 4 AD or 8 AD was the first AD leap year. But less clear what such a year would have been called by Romans at the time. I'm assuming it wasn't common to include full dates (including the year #) on written documents at the time, otherwise surely we'd know pretty much exactly. I gather AD-based year numbering wasn't actually introduced until ~525 AD (but before that a number of systems had been in use).

0 is a year if we say it is, which astronomers have for hundreds of years (because its extremely mathematically convenient), and which ISO-8601 does.

Year 0 is what historians like to call 1 BC, but historians are also just making that up. Nobody numbered years from Anno Domini anywhere near year 0.

I'm sure it's clear to everybody here why year 0, -1, and -2 are significantly better arbitrary, ahistorical names for the three years preceding year 1.

leap year? what? I guess I had passed that by accident, 4 and 8 were leap years I guess?

Spoiler: You can save a couple characters by using PepSi (Pepsi + Silicon) which answers 2 requests.

I keep getting illegal move on the chess problem.. although my move is not illegal.

  [Variant "From Position"]
  [FEN "3k4/1p3Bp1/p5r1/8/P3P1N1/5Pp1/1P1r4/2R4K b - - 0 1"]
  
  1... Rgd6

When I put Rgd6 I get "d6 (Illegal move)"

I'm not sure if this is your problem, but you have to include captures (x), check (+) and checkmate (#) if applicable

Try Rd6 or Rd6+ for check.

Or Rd6++ for check mate

# is check mate, ++ is double check.

For the country one, I got "www.google.com/maps/embed?pb=!4v1687119352692!6m8!1m7!1sINHBz4HdSwMAAAQrBnftjg!2m2!1d9.080961517214682!2d7.524398838108427!3f84.34!4f-4.950000000000003!5f0.4000000000000002"

I think it should be 9.08N, 7.52E and it works

In one of my tries, I got a 3D model for the Geo guesser puzzle. Anyone know what/where this is: https://imgur.com/gallery/7r13Et9 ?

Edit: I had saved the url, but I don't know how to use it - https://www.google.com/maps/embed?pb=!4v1686332716861!6m8!1m...

Try Dubai or Abu Dhabi?

I can no longer access it now. But I have posted the Google maps embed link if that helps.

Doha: https://www.google.com/maps/@25.0897073,51.1817779,0a,82.2y,...

Thanks, that's the one!

Got to level 31 on mobile.

The different font sizes for different characters ended up crashing the browser. I went out just after this:

> XXXV-75-may-Shell-dbfen-straw--china-Qf5+-0000-i am loved- https://youtube.com/watch?v=BprGlhu_Hfs- Po-@@@@@-@@@@@-@@@@@-@@@@@-@@@@@-@@@@@-@@@@@-@@@@@#cd1520-xngxc-$$$$$$-$$$$$$-$$$$$$$-$$$$$$-$$$$$$-$$$$$$-$$$$$$-$$$$$$-$$$$$$-$$$$$$-$$$$$$-$$$$$$-$$$$$$-

Edit- emojis don’t save..

Couple of tips.

- 0000 is a leap year and doesn’t add to your numbers tally

- “not strong enough” - paste the strong man emoji three times.

- hex color - screenshot and upload to a hex color picker (on iOS turn off the screen dimming). Choose a hex color with low numbers. Enter as lowercase to avoid creating more chemical elements such as “F” and “C”

- chess move - install Chessvision.ai and upload screenshot. Taking a piece add an “x” between the piece taking the move and the target square e.g. Qxe5. Taking a piece and putting the king in check Qxe5+. Checkmate Qxe5#

- captcha - avoid numbers. Leave all lowercase. Avoid captchas that could be confused for a chess move (e.g. contains “e5”)

- YouTube URL - google “mm:ss YouTube” replacing the minutes and seconds. Only use one without Roman numerals and very few numbers in the URL. The times are shown in the screenshot on google search

- on fire? Smash the delete button. Add loads of zeros to pad it out to give yourself a chance. You can delete them later.

- copy the password regularly in a notes file. After Everything goes up on flames you can paste it back in

- country - enter it in lower case. Take a look around if you can and hint for tips. Road signs, tree types (cold or warm climate), road name overlays, advertising, company names, etc. only once I couldn’t figure it out. Middle of a ruined castle??

- you not allowed to overfeed Paul. I kept him up at 5 bugs and it allowed me to jump between apps and jump back. Maybe you can add more but I didn’t risk it.

- ChatGPT can help you with the periodic table and help you with the math.

Almost gave up on the Chess notiation, but now "All the vowels in your password must be bolded." clashes with the requirement to include a captcha and reloading this unleashes all kinds of problem, so game over

I spent forever trying to find a YouTube video that was precisely 16m18s, and when I finally did, the video ID included periodic elements and Roman numerals that broke my earlier rules, and I gave up. Fun game though!

I'll copy a comment I made earlier:

"00:00 / <minutes>:<seconds>" youtube

Google that, including the quotes, replace the minutes and seconds with your given time, then look through the results and find a URL which fits the password criteria.

Every result should be a video with that duration. If it isn't, check your useragent. I noticed some weirdness with that.

Can you give an example? "replace the minute and seconds" is vague. Do you mean replace the words "minute" and "second"? Or just the numbers? Do you remove the brackets too?

Seems pretty self-explanatory:

> site:youtube.com "00:00 / 16:18"

Or you know you could just try to work it out for yourself.

I tried literally this and I just get videos of random length with various matches in the comments and descriptions. It completely ignores the double quotes here. I've even tried setting my user agent to Chrome on Windows without any change.

It sounds like the problem I was having on FF. Switch to Chrome and see if this problem persists

Tried Chrome on multiple OS, still not working

Gave up at the YouTube video. My final password:

cmabout[gibbous emoji]swedenQf8+[chicken emoji]Tir8gecmVshellapril9Fe[weightlifter][weightlifter][weightlifter]VIIamloved[caterpillar][caterpillar][caterpillar][caterpillar]

Should help https://news.ycombinator.com/item?id=36499194

I overfed Paul :(

111about[weightlifter][dead paul][worm][worm][weightlifter]VIIamlovednovemberen4n41E2111shellV[weightlifter][weightlifter][worm][worm][worm][worm][worm][worm][worm][worm][worm][worm][worm][worm][worm]

Well. I got stuck.

Rule 9: The Roman numerals in your password should multiply to 35 Rule 14: Name this country (Malasysia for me)

Given that M=1000 in roman numerals, I need to find x such that x*1000=35

How do I write 0.035 in Roman Numerals?!

Change it to “malaysia”. It accepts lowercase for country name and only recognizes uppercase as Roman numerals.

ƧƧ is a decent approximation (that's two backwards capital S glyphs, if it doesn't render)

Fun!

But I wasn’t able to finish: I got a captcha with digits 5, 3, 7, and 8. When the chessboard appeared, the best move was Qe6. These conflicted with the rule to have all digits sum to 25 (5+3+7+8+6=29).

You can re-roll the captcha.

If you use duckduckgo to search for youtube videos that's the easiest way over that hurdle because DDG will show the length of the video as an overlay for the thumbnail. Just search for "17 minute timer" or whatever is the closest but less than the length you need. Make sure to sort by short/medium/long as well to limit it to the proper window.

Made it to "the length of your password must be included in your password" and decided to throw in the towel.

I just typed in "6 minutes and 55 second" in the youtube search and someone had posted a video called "6 minutes and 55 seconds of X"

Solved! https://imgur.com/a/fZjalRA

A funny game! For anyone else struggling with the wordle, the answer is here[1]. For anyone else struggling with the country, you can fill in the names of all the countries, then run a bisection.

[1] https://www.nytimes.com/svc/wordle/v2/2023-06-28.json

or you can look at the URL of the google maps embed in devtools then ask chatGPT either to give the location or just the latlong that you can subsequently google :) Chatgpt got the location wrong just 1/4 times

So does this sometimes reach an unsolvable state? I have a captcha whose digits sum up to 24, a condition that all digits should sum up to 25, and the best chess move is Ne6+ (accepted), but there's no way to get all digits to sum to 25!

mAy@VpepsiVIIm3588tractSibelgiumNe6+

m3588 is the captcha and Ne6+ is the chess move in the above

I've also tried putting something like -5 in the hope that it recognizes negative numbers, but no luck!

When you break the captcha rule, you can re-select the captcha. You want to keep re-rolling till you find a low number combo. There are a few rules where you can re-roll to get a better random number. In general, it gets harder and harder to stay under the 25 limit as you progress.

You can refresh the captcha to make it work.

Hello guys, for level 16 (Chess level) if you cant get pass it use this website https://nextchessmove.com/ How to use? make the chess board on the website the same as the one on The password game then press Calculate button. Have fun! Edit : press reset to get the full board!

This was fun until I reached the time-sensitive rules

Find a Flaw in the logic!!

I had a captcha value "ex0888" and the answer for the chess puzzle was Rd8+. Now I can not statisfy the Rule "digit sum adds up to number 25" cause total of all the digits in password was exceeding the 25. Can't go ahead of this!

But It was fun playing and keeping up all the rules!

Lost at Paul was over fed. Took so much effort to make atomic numbers sum upto 200 while ensuring Roman Numerals multiply to 35. Smh

What's the chess puzzle? Q×h6+ is not working for me?

Everyone gets a different puzzle

All rules in this game!

1. Your password must be at least 5 characters.

2. Your password must include a number.

3. Your password must include an uppercase letter.

4. Your password must include a special character.

5. The digits in your password must add up to 25.

6. Your password must include a month of the year.

7. Your password must include a roman numeral.

8. Your password must include one of our sponsors. (pepsi/starbucks/shell)

9. The roman numerals in your password should multiply to 35.

10. Your password must include this CAPTCHA:

11. Your password must include today's Wordle answer.

12. Your password must include a two letter symbol from the periodic table.

13. Your password must include the current phase of the moon as an emoji.

14. Your password must include the name of this country.

15. Your password must include a leap year.

16. Your password must include the best move in [algebraic chess notation].

17. ← This is my chicken Paul. He hasn't hatched yet, please put him in your password and keep him safe.

18. The elements in your password must have atomic numbers that add up to 200.

19. All the vowels in your password must be bolded.

20. Oh no! Your password is on fire. Quick, put it out!

21. Your password is not strong enough

22. Your password must contain one of the following affirmations: (i am loved, i am worthy, i am enough)

23. Paul has hatched! Please don't forget to feed him, he eats three every minute.

24. Your password must include the URL of a <random> long YouTube video.

25. A sacrifice must be made. Pick 2 letters that you will no longer be able to use.

26. Your password must contain twice as many italic characters as bold.

27. At least 30% of your password must be in the Wingdings font. 28. Your password must include this color in hex.

29. All roman numerals must be in Times New Roman.

30. The font size of every digit must be equal to its square.

31. Every instance of the same letter must have a different font size.

32. Your password must include the length of your password.

33. The length of your password must be a prime number.

34. Uhhh let's skip this one.

35. Your password must include the current time.

36. Is this your final password?

You can't pass 36. Just saying.

Honestly not sure how you'd pass the youtube one, unless you were incredibly lucky

by searching for the length in your favourite search engine :)

There doesn't seem to be a way to search YT videos (except videos you yourself post) by exact length. I got 21 min 45 seconds. Looking up "3000 second timer" on YT got me close (only 4 seconds out), but not exact. Do you have a way to find exact-length videos that I'm missing?

I think you just have to search for it and hope for the best, my query got me this video which is hilarious: https://www.youtube.com/watch?v=RRoUEr1l0n8

I found exactly the video I needed by searching "38 minute video" and one of the "timers" was the required 37m58s, but Paul died just as I found it.

It would have likely screwed up your previous answers -- roman numerals etc.

I figured out a way to get a list of videos all matching the time you want. Should help. https://news.ycombinator.com/item?id=36499194

I found one by the United Nations. In the meanwhile Paul starved to death.

"Youtube Time Filter" Chrome extension

And then what happens after 36?

You have to repeat the password before a bomb explodes. I tried to somehow copy it using developer tools, but did not manage to do it in time :(

Wow that is tough. The country part stumped me and I had to give up cause I also have a day job . Excellent work Neal!

Got to the retype your password one and didn't copy beforehand. Not going through that again...

I got a "Paul has been slain" message, when I deleted half my password to debug something. Weird.

Got to the vowel capitalization.

Paul is the chicken

It's not capitalization, it's about selecting the characters and pressing the "bold" button.

Or just ctrl-a + ctrl-b

Awesome game. Didn't think it was possible to LOSE at picking a password but there you have it. LOST at finding a 16m48s youtube video and a lovely passw0R.513mayIshellXXXV8pfxxtractAusingaporeRh8+ iamenough

When entering the chess game moves make sure to add `x` when taking a piece, `+` when checking, and `#` for checkmate.

Here is a simplified daily edition: https://passwordgame.org

This is now my new favorite way to explain to people that passwords should not exist. Long live FIDO2 and passkeys.

I don't think passwords will be replaced. This is more of a demonstration of over complicated password rules, than against passwords itself.

Hardware and biometric keys can be stolen, cloned and lost. And trusting third-parties with keys to harddrive encryption is also not really trustworthy.

1. You can have multiple hardware keys or devices bound to an account as a backup of for ease of use.

2. Passkeys allow you to pick a backup solution of your choosing. Could be your own nextcloud server in the corner. This is no different than giving someone a choice of cloud-synced password manager

Both solutions avoid phishing, password re-use, keylogging, or people picking weak passwords.

There is no excuse for anyone even supporting passwords at this point. Sysadmins have not commonly used passwords for ssh in 20 years, favoring private keys on either hardware or encrypted disks. Keys better than passwords-over-the-wire in every way.

> 1. You can have multiple hardware keys or devices bound to an account as a backup of for ease of use.

How does that help if someone steals your hardware key, login in with it and then puts it back. You don't even know that it was stolen and your account was messed with. With a good password you know if you tell someone. Granted people could film you typing your password, but stealing your hardware key is much easier.

> 2. Passkeys allow you to pick a backup solution of your choosing. Could be your own nextcloud server in the corner. This is no different than giving someone a choice of cloud-synced password manager

This isn't about backup, but trust. Do I trust a third-party to manage the keys to my kingdom? No. And even if, the third-party is a much easier target for 3 letter agencies, governments or other rich/influential bad actors. Also I haven't seen a solution where passkey can be used to decrypt my LUKS partition.

> There is no excuse for anyone even supporting passwords at this point. Sysadmins have not commonly used passwords for ssh in 20 years, favoring private keys on either hardware or encrypted disks. Keys better than passwords-over-the-wire in every way.

The encrypted disks are hopefully protected with a password, and not magically unencrypted, just by booting it with the right TPM configuration. The hardware hopefully requires a pin or password in order to unlock the SSH key, and the SSH key on disk is hopefully encrypted with a password as well.

1. If they have the access to steal your hardware key then they also probably have access to replace your usb charging cable with a malicious one, or install a keylogger on your system, or place a microphone or camera near you for acoustic or optical keylogging. All ways your password could be stolen without you knowing. If your yubikey is stolen at least you find out fast and could warn your IT manager to lock you out. Still, 99.999% of all threats are online, and for the rare few that have physical theft of keys in their threat model, then you have the option to set a pin on your yubikey with a 3 try lockout. Or you can use touchid, or another platform authenticator built into your laptop. If they can steal your unlocked laptop, then neither passwords or passkeys are going to help so this is moot.

2. Fido2 lets you decide who to trust. A non technical user can use google or apple or a hosted nextcloud instance as a backup. A technical user is more likely to enroll the TEEs built into their phones and laptops, with a yubikey in a safety deposit box as a backup.

Passkeys and FIDO2 offer a massive reduction in attack surface and are superior to passwords in every way for every threat model I have ever heard of.

You have all the same options for managing a fido2/passkey/webauthn key as you do an ssh key.

Web passwords should go die in the same fire as SMS 2FA.

> 1. If they have the access to steal your hardware key then they also probably have access to replace your usb charging cable with a malicious one, or install a keylogger on your system, or place a microphone or camera near you for acoustic or optical keylogging. All ways your password could be stolen without you knowing. If your yubikey is stolen at least you find out fast and could warn your IT manager to lock you out. Still, 99.999% of all threats are online, and for the rare few that have physical theft of keys in their threat model, then you have the option to set a pin on your yubikey with a 3 try lockout. Or you can use touchid, or another platform authenticator built into your laptop. If they can steal your unlocked laptop, then neither passwords or passkeys are going to help so this is moot.

You are jumping around various attack scenarios to make your point. If your child steals your hardware token to shop on amazon and then put it back afterwards is a different and much more likely scenario then some targeted attack by some hacker that is prepared and breaks into your home...

Most online threads are about social engineering, where the person that is attacked actually cooperates with the attacker, AFAIK there is no safeguard against that, other than not trusting people with their own stuff.

I would worry more about someone stealing a locked laptop. If there is no password (or other kind of knowleged based protection), then they have everything they need to unlock it.

> Web passwords should go die in the same fire as SMS 2FA.

So since you limited your argument now to just Web passwords. Does that mean you agree with me that you don't think there is a good solution to replace passwords for encryption or local authentication that works offline and doesn't move the trust away from the user?

Web passwords are the primary issue. Secrets that are local on your system with hardware enforced rate limiting, such as a pin on a yubikey, are reasonable. Pins are short and memorable. Passwords generally must be 256 bits of entropy and thus not easily memorable.

You can do FDE with a smart card+pin or smart card+biometrics depending on your threat model.

I consider a pin provided to local hardware or for local decryption different from the concept of a password as is widely deployed on every web service under the sun.

Services should never see your secrets though, only public keys.

I assumed we were talking about web passwords given that is the only scope FIDO2/passkeys cover.

> Web passwords are the primary issue. Secrets that are local on your system with hardware enforced rate limiting, such as a pin on a yubikey, are reasonable. Pins are short and memorable. Passwords generally must be 256 bits of entropy and thus not easily memorable.

I consider PINs, passwords and passphrases as the same thing, just different rules to create/input them. Numerical PINs might be easier to remember, but as with unlock patterns on a phone, it is also easier to casually observe someone entering and memorizing it.

Biometrics I am not a fan of, because they can be stolen without you noticing. With password you have to enter it in an untrusted environment, which takes more effort to setup. Also biometrics cannot easily be changed if they leak. And they also change with time and events involuntary and some people even have identical biometric data.

> I assumed we were talking about web passwords given that is the only scope FIDO2/passkeys cover.

The discussion started with wanting to replace all passwords.

I don't know anything about passkey, but FIDO2 can be used for harddrive encryption: https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-...

IMO, 2FA via hardware key etc. next to a password/PIN it great, but IMO some kind of proof of knowledge can not be replaced by just a proof of possession.

If using it as a security key (with a password) you don't need to give the device anything but a tap usually.

However, if you use a Yubikey or Trezor for example as a Passkey (No Password), you have to enter a pin on either (Yubikey via OS and Trezor on device) before they will fulfil the request and log you in.

> However, if you use a Yubikey or Trezor for example as a Passkey (No Password), you have to enter a pin on either (Yubikey via OS and Trezor on device) before they will fulfil the request and log you in.

Personally I consider a PIN, password or passphrase the same thing, just different rules. It is security based on knowledge. So If I enter a PIN somewhere it is still a password. IMO this is fine.

I'm stuck on the chess thing as well, and this time I do think it's a bug. The board in FEN notation is 8/7p/5pk1/3n2pq/3N1nR1/1P3P2/P6P/4QK2 w - - 0 1 The best move is 'Qe8+' and that is exactly what I have put in. Including the '+' sign.

Are some of them unsolvable? Mine says has to include the captcha 52447 & chess move Rxg6+ & leap year and add up to 25.

From the captcha + the chess move alone I am already above 25... I tried subtracting, did not work. Anyone have an idea here?

This is great! I built a very similar thing a while ago - https://www.funnypasswordchecker.com/ Definitely not in the same league but it was a lot of fun!

Got to the final answer but then I had to re-enter my password before a bomb blew up and it wouldn't let me copy my password. Anyone manage to do that last part? Is it even possible e.g. if you copy your password before that's disabled?

I copied it when it asked me to confirm my password and pasted it.

It worked instantly.

Yeah I redid the whole thing and copied before the last step. Successfully created a 211 character password.

This game is great! Even though I will need to catch up with whatever was happening in my class for the last 2 hours, I thoroughly enjoyed my time and the fact that I have no idea what the professor is talking about is a sign of how engaged I was.

Funny game, but it seemed to break for me when trying to find a YouTube video of length 4:55. I entered multiple videos of lengths 4:54, 4:55, and 4:56, all while keeping Paul fed, but none of them satisfied the requirement somehow.

> Rule 5: The digits in your password must add up to 25.

Im already stuck here with `Password!25XXV` or `Password!1234567890123456789012345` or `Password!34` (9+25)

I'm not native english, so if there is a pun in the rules description, I might not get it :'(

It means sum, so 55555 would work

got it, thank you!

It means individual digits e.g. 997 === 9 + 9 + 7

It’s the sum of the individual digits, so 25 sums to 7, and your second one sums to way more than 25

funny that i had to remove weight of my initial digit since the CAPTCHA (rule10) :>

The captcha could itself add up to more than 25, making an immediate game over

Same. I had a captcha and chess move that added to 29.

Copy your password and reload to continue with only a few missed rules.

You can request a new captcha without restarting

I am stuck with “ Agtractbnc2fshellXXXVjune995$” and can’t figure out the guess the country one. I have the one where you are in a cave with a lot of people with a hit with a no smoking and no shoes sign

I may have had that one; there was southeast asian writing on a sign and it was Malaysia.

This just goes to show how wise it was to write a script for cheating on Wordle.

Aww i overfeed paul while trying to find a suitable youtube url. It ended with: SmSm#aro#Qg8+1196decemberpepsiXXXVxbcbxI am loved about[moon-emoji]kenya[paul][lifting][lifting][lifting][worm][too many worms]

Here are some leap year digit tallies[0], which might help a few people.

[0]: https://pastebin.com/hNVR2MG6

I just use 0000 ;-)

I loved the Google maps street view bit. I couldn’t exit street view and the road signs were in Cyrillic. Had to walk a long way before I could search for some landmarks and guess Belarus.

I was dropped into the ruin of an ancient amphitheatre (the tourist/foot StreetView thing): https://www.google.com/maps/@31.9520096,35.9393566,2a,75y,14...

After a 'walk' I saw flags which confused me, but it turns out this country has a very similar flag to its neighbour.

Didn't know you could move, but then, why would I when I was shown a beach in Israel.

Hah! I was wondering about that. Mine dropped me into what looks like a 3D modeled version of a real place, but sandboxed - there's no way to move around.

(that iframe embed is: https://www.google.com/maps/embed?pb=!4v1686332716861!6m8!1m... )

It led me down the path of reverse engineering these URLs though, so that's fun.

here is the street view link:

https://www.google.de/maps/@25.0897073,51.1817779,3a,75y,268...

That's great! How did you get that?

I walked around a lot but couldn't figure out the country. I refreshed and the next one was on some cliff that I couldn't move so I pasted a list of all countries and then started deleting in a binary search fashion until I was left with the correct one.

That’s excellent

I had openstreetmap redirect enabled and it broke it for me. I only got a blank iframe so I had to decode coordinates from its url.

Finally finished it. It has been so stressful.

"Congratulations! You have sucessfully chosen a password in 211 characters."

I got lucky when I found a bug with Paul (otherwise I would have given up)

Can you explain the bug?

I made it up to Foo997!JanuaryVIIVStarbucksxbcbxTRAcTcambodia and it was a lot of fun, but I don't have the patience of somehow working a leap year into it

it does help you find a really strong password, sponsored by Pepsi!

Make it PepSi for bonus points on other tasks.

Well, my chess move is Nd3+, and Nd gives an atomic number of 60. That plus V and VII gives 212. Adding an “n” to VII reduces it to 208, but I am screwed, no password for me…

XXXV also works

Jesus, of course thanks

I only got to the captcha because I was on mobile and couldn't be arsed to make precise edits, but I am very impressed by how slick and funny they made a password modal

Cannot get past rule 5, tried a bunch of different solutions from this thread but nothing works. Maybe a browser quirk ( I'm on Brave IOS)

Anybody else have the same problem?

I was confused for a while but it means the individual digits when summed should total 25. That worked for me.

Reached 28 and forgot to feed Paul. That Rule is so frustrating

I started this just before midnight, and once I got to the wordle question it didn't work. Possibly because the wordle had changed since starting the password game

I'm stuck on the chess one.

The best move is Queen to e8, which I'm sure is represented in algebraic notation as Qe8. But it says that Qe8 is invalid notation.

Try Qe8+ if it's check or Qxe8 if you're taking a piece.

Thanks! That worked, it was a check.

It was fun until I had to provide an answer to Wordle, a game I have never played, did not know about, and really could care less about. gg though.

Btw about the URL problem. I came up with the solution to use a YT link shortener in order to be able to keep the 25 and 200 atomic number rule.

Im stuck at "aaaaA?kmayVPepsiVIIn373n-tract.Fe Romania 20-111

Rf7+"

in rule 18 The elements in your password must have atomic numbers that add up to 200. Please help!

I know nothing about geography or landmarks so I just grabbed the lat/long from the Google Maps iframe embed and looked it up.

Turned out to be Cambodia for me!

This is awesome, I kind of want to use it now instead of a password generator, I got as far as the chess move. 20+599July.XXXVpcedepepsiABOUTBechile

Chess move came out at Rg1+.. romand numerals multiplied are 35 - so VII * V

Atomic number of all of these combined: 113 + 23+53+53 + 23=275..

Looks like Im not going to complete it

XXXV * I

Oh, duh..

Reminded me of this video:

https://youtube.com/watch?v=WqnXp6Saa8Y

Super fun. Sadly I accidentally killed Paul by misclicking while trying to simultaneously include the right elements and Roman numerals.

I gave up at "the current phase of the moon as an emoji." Looks like so of you guys tried harder than I did

Was fun until I got "what's today's wordle"? Wasn't googleable enough for me and I don't play wordle.

literally the first result of "todays wordle"?

The first result of "todays wordle" is AI-generated blogspam that might have the answer buried in there somewhere. The first result of "today's wordle" is the wordle game itself.

This has slowed down productivity in my and my friend's companies to a grinding halt. Thank you so much.

HELP ME ON RULE 18 MY PASSWORD IS Asslover2!6556 JanuaryXXXV sponsored by Pepsi nydfe diner germany ra1+

https://imgur.com/paCJTiR

Oh god, I got to the part where the password starts catching on fire, eventually poor Paul was consumed by the fire.

I deleted Paul :-(

Once I overfed [name], I reached my limit

i cannot get past the rule 5 where it says your password must have digits that add up to 25, my password is this currently TheU youtuebrmilliondollarsjulyXXXVpepsixgcxytractsweden0Rh8+ ive gotten up to rule 16 in total but every time i go to progress it says that i have to complete rule 5 again

Got to rule 35 where I had to include the current time and it was impossible to do… how many rules are there

finally did it after 10 attempts and several hours.. my password was "[paul]#################7Ge101#2ad2be1:00dpbydstrawmaypepsi[worm][moon][weight][weight][weight]iamlovednorwayQxh7+youtu.be/__uIuGojJU4XXXV"

Got to rule 33 after like two hours! The cap on adding up to 25 becomes really tough with the later rules.

Got stuck at rule 18, not sure what an atomic number is in this context

Password26$_june_pepsi_VIIV_33p4e_about__germanyQxh7+

P = phosphorus, atomic number 15

V = vanadium, 23

I = Iodine, 53

So in your password they add up to 167

Actually Pa from "Password" will br Protactinium at 91. I also started off by typing password and had to change the Pa to a smaller element.

Oh man I feel silly, I’ve spent the past few days doing Project Euler puzzles and was fixated on it being a number satisfying special properties

I suspect a bug: I got the chess solution Rh2+ that also matches an element with too high atomic number..

Yep, same here with Re and then something

Had to stop at the "Name of this country" question because the iframe was blocked by uMatrix.

> The elements in your password must have atomic numbers that add up to 200.

And I'm out lol. Fun game though.

hey it lets you use multiple elements for this one. I used Hf, Ir, and Ni to get to the next rule.

I tried it and it didnt work

I got to rule 16 — I don't know chess #2x8+183SeptemberVIIxVShellgnc3nTRAcTKenya

on rule 18: "The elements in your password must have atomic numbers that add up to 200." My element is "Na" and it says my roman numerals are a problem. They are "VI" and "IV". Not too sure where to go from here.

Hint: V = Vanadium and I = Iodine.

the roman numerals are all good man its the elements. the "N" in "Na" is adding 90 onto the numeral rule, for rule 18 you can use multiple two letter elements just try and find ones that don't contain roman numerals and you'll be fine

Password wouldn't recognize chess moves on row 7 or 8, and the best move was on row 7!

I got Netherlands as country and I can't make L and D roman numerals to multiply to 35

you get V times VII ?

I love it. I especially love that it doesn't tell you what's wrong until too late!

Paul (the chicken) starved while I was trying to find the YouTube video. I’m sad.

The iPhone keyboard wiped out my progress when the Roman numerals part started.

Man I miss my Android.

Fun game though.

Lost at Rule 24. Really shouldn't ignore the 1 minutes feed notice ^^ Fun game btw.

Lost there too doing the opposite... I tried to get ahead of 3 per minute by creating a nice stockpile. Dead from overfeeding.

How do I get past Rule 21 "Your password isn't strong enough "

Copy the strong emoji in the rule three times

I'm stuck at the atomic numbers rule... Does someone know how to solve it?

Because of the personalized nature, you can end up with elements that make it impossible.

For example, "VII" and "V" is forced by Roman Numerals needing to multiply to 35. Then, my chess puzzle was "Rf7+"

The atomic numbers - V: 23, I: 53, Rf: 104

2×23+2×53+104 adds to a number over 200, which is frustrating because it seems like there should be a trick, or it should at least be solvable

you can just use switch to XXXV. No I needed.

Work out what you must have based on the rules, list them out, then subtract from 200.

For me, V and VII from the roman numerals = 152 so I needed 48. Did He and Pd. Then of course a later rule came along.

The elements in your password must have atomic numbers that add up to 200.

This made me angry. Good job.

I got to the chess move and didn't feel like putting in the effort there.

My password caught fire at Stage 18 and Paul sadly became an burnt omelette!

The digits in your password must add up to 25 what do they mean with this?

about9_9_7

you can go with any combination usually

55555 = 25

64555 = 25

you get the gist just add the digits til you get 25

excellent! now can you solve this? https://neal.fun/password-game/

Stuck on Rule 21 "Your password is not strong enough "

my password got on fire, i lost it, how? no idea, i'm pissed off

This is so much goofy fun. Thank you so much for making this. :)

So Neal solves Wordle every midnight to keep this game running?

Not sure if this is currently the case, but Wordle used to have the entire list of words for each day served in client-side code (I believe it was a static list with modular arithmetic, or something along those lines). So doing "view source" would not only tell you the current day's word, but also allow you to view the answers for any future day.

When the NYT bought the site, they shuffled the word list but (at least at first) kept this system. They may have obfuscated it by now though.

Either way, since Wordle is a free game, it's not difficult to automate a script that will attempt to solve it and grab the correct answer.

Not sure exactly where the data comes from, but the game uses an API at https://neal.fun/api/password-game/wordle?date=2023-06-15

Seems like it has answers up to July 30, so he's either a time traveller or it's possible to get future answers by looking at the Wordle source.

I thought the NY Times had reworked it so you couldn't see the answer in advance anymore, but maybe not. The current code is too obfuscated for me to figure it out easily.

I'm stuck at the atomic numbers rule... How to solve it?

Look at the periodic table and find elements that add up to what you need. In the game lowercase letters will not count as an elemnet unless paired with an uppercase, so either 1 capital letter or One capital and one lowercase letter as the atomic symbols.

my country was Georgia, i got the coordinates using devtools...

i gave up when it got to chess, guess "55A%SeptemberXXXVStarbucksgny6baboutgeorgia2016" will have to be enough

It's easy to spam guesses of moves until you get approved.

This is the most fun I've had wasting time in months.

finished it, finally, https://i.imgur.com/SP8JOSs.png

Really well done. I loved the password on fire part! :)

can someone help me on rule 18 (the elements in your password must have atomic numbers that add up to 200)? I'm not sure what it's asking 3:

It means that whatever strings in your password that are elements in the periodic table, should have atomic numbers (in the periodic table) that add up to 200.

So go find a table on wikipedia, add up the elements it already recognized and choose strategically a couple of new ones to add !

Each element maps to an atomic number: https://www.angelo.edu/faculty/kboudrea/periodic/structure_n...

It should highlight the likely multiple atomic numbers that are already in your password.

HHeLiBeBNOFNeNaMgAlSiPSArK” verwenden, da die Ordnungszahlen von Wasserstoff (1), Helium (2), Lithium (3), Beryllium (4), Bor (5), Stickstoff (7), Sauerstoff (8), Fluor (9), Neon (10), Natrium (11), Magnesium (12), Aluminium (13), Silizium (14), Phosphor (15), Schwefel (16), Argon (18) und Kalium (19) zusammen 200 ergeben.

can someone help with rule 18 (the elements in your password must have atomic numbers that add up to 200)? I'm stuck on what it's asking 3:

Look up a periodic table and correlate the highlighted letters with numbers on said table.

Change, remove, modify letters until you reach 200 based on the sum of their atomic numbers.

For easy cheese, add H to increment by 1. Repeat capital H until you have reached the sum if you are under. Easy to later add and remove H until you satisfy the condition.

I found the video .... but the elements now ....

This is how Chase Bank password policies feel like

RomanianPepSiPotat0VžVII3p4nn57aboutJuneQe6+

I feel this password field is Turing complete.

The fire part took me by surprise, RIP Paul

I laughed out loud many times, thank you! :)

RIP Paul. This was really hard on mobile.

Super fun game ahah thanks for making!

today's wordle contains a C, but the game doesn't know about roman numeral fractions :(

Type it in lowercase and it won't count against the Roman numerals.

rip Paul, but also I love this concept. I would love to see it expanded with more varied requirements!

I want to say that i really hate you

im stuck on question 16 and what annoys me is that everyone gets a different puzzle

Why is that annoying? I think it's great that you actually need to craft your unique password and can't just copypaste a solution.

Do we need to put out the fire?

Oh no my chicken is dead. LOL

I gave up when I overfed paul

same :)

I learned alot today. #win

F... the on fire part :D

What is this abomination.

It's called a "joke".

> The digits in your password must add up to 25.

> X4X5I6V7V8V9!

Unclear what is not adding up to 25 here. Is it a bug?

4+5+6+7+8+9 > 25, no? They mean exactly 25, not at least 25.

This is the concept I was missing. Thank ya.

4 + 5 + 6 + 7 + 8 + 9 = 39

> > X4X5I6V7V8V9!

> Unclear what is not adding up to 25 here. Is it a bug?

4 + 5 + 6 + 7 + 8 + 9 = 39

Let me guess. You often think it's a bug in the compiler.

What does rule 5 mean

RIP Paul :')

hyub

StinkyFish01

i still can't pass rule 5

fun! i stopped at 'today's wordle answer' since i don't know (or care) about such things.

Same for me. Never looked at "wordle" once.

ABOUT

Thanks for letting us know that you don’t waste your precious time with such frivolities as Wordle.

what is the answer to rule 14

Brilliant!

I lost at rule 35 (out of 36) because I overfed Paul.

Some tips I gathered: 9. Use XXXV, as the chemical symbols contained in (V,VII) add up 152, which is already very close to 200 for rule 18; 10. Refresh the captcha so that it only includes lowercase letters, you'll need numbers later and they can't add up to more than 25 according to rule 5; 14. Pray for having a country with a short name, whose first letter isn't also a chemical element and that includes common letters (curse you Zimbabwe); 15. I think 4 is a leap year... 17. Put Paul at the start or the end of your password; 19. You can bold the whole string to meet the condition, but beware of rule 26. Also, before meeting the condition, copy-paste your password elsewhere; 20. Just select the fire and some more characters and delete them, then fill the gap from your copy-pasted password; 22. Use "i am loved" (all lowercase, cf. rule 18) as you'll need to sacrifice two letters for rule 25, but you will already use 'o' for youtu.be, 'v' for XXXV, 'e' for youtu.be, and probably 'l' and 'd' in your captcha, URL (cf. rule 24) or color (cf. rule 28). Also, it's the shorter word of the three, and for rules 32 and 33 it's simpler to add padding symbols than to remove mandatory characters to control the length of the password; 23. Try to have between 2 and 6 max worms at any time, it should give you enough time to think without overfeeding Paul. 9 worms will definitely kill Paul (maybe less, but 6 should be safe); 24. On Chrome, you can use the "YouTube Time Filter" extension to find videos of the correct timelength. On YouTube, type a very generic request (like "game", "car", or even just "p"), open the filters and choose "Video" (to filter out shorts) as well as a length range (to reduce client-side filtering) then in the YouTube Time Filter insert a length range one second before and one second after the required range (the game has a one second leniency). Then scroll and scroll. Of course, once you find a suitable video, strip any superfluous parameter from its length, and make sure that the video id doesn't include any uppercase 'M', 'D', 'C', 'X' (because those roman numerals don't multiply to 35, cf. rule 9) and preferably no 'V' or 'I' (because of rules 9 and 18). It's hard, but with a bit of patience, it doable. Also use the short URL (youtu.be, not youtube.com) and trim the "https://www.", you don't need them; 25. If you applied those tips correctly and you were lucky on the captcha and the country, you should be able to strip the letters 'w' and 'z' at the very least. Other letters if you were very lucky (maybe try to choose another month for rule 6 if it can make you unuse a letter, or maybe you should have used "i am enough" ?); 26. Just put the whole string in italics; 28. Refresh until you have a color without numbers (or 0 at most), for rule 5; 32. It's better to have 123 characters than 97 (cf. rule 5); 33. Sorry, I meant 113. Other probable candidates, depending on your current password length are: 101, 103, 113, 131, 151, 211, 223, 233, 311 and 313. Other numbers are fine too, but it's up to you to see if you can have them depending on your URL and chess move. Maybe include 8 padding symbols at the end of the password, in prevision to rule 35. Know that the length will vary when you feed Paul, but the length should usually be correct; 34. Just skip this one, really; 35. Unfortunately, I didn't pass that one as I overfed Paul, but I think it would be easier to play around midnight, ideally at 00:00:00, because you know, rule 5. But make sure to write it at 23:59 and change the police size to 0px before midnight, so every rule can be met at midnight. Not sure if the seconds are needed or not, since I didn't pass it.

To add a couple of things to this: 9. I use XXXV (23), He (2), Fm (100), these make it easier to adjust the symbols later on. 15. 0 is a leap year 20. Ctrl+Backspace will delete the whole fire if you place your cursor at the end of it 24. If you type your exact time into youtube (e.g. 32:15) you will find many videos with that length, bad thing about this solution however is that if you're given a time that can also be a date (e.g 21:01) you'll just get a bunch of news broadcasts from that day.

Also I think the limit for Paul is 5 caterpillars, I keep it at 4 just to be safe though.

Seconds aren't needed. Also, copy your password before confirming it! You'll need it on the clipboard for the next step...

how to do the atomic 200

what is rule 5 idk how

wtf is the answer??

what is rule 14

do people here have so much free time on their hands ?

how is rule 5

Congratulations! You have sucessfully chosen a password in 131 characters. https://files.catbox.moe/uvkktj.png

bare

juneshellaboutromania XXXV Fm IxbcbxRxg7+ 2 131 % (.)(.) i am enoughhttps://www.youtube.com/watch?v=e3h3exBxTKs#1daebe 11:20

encoded plaintext

data:text/plain;charset=utf-8,%F0%9F%90%9B%F0%9F%90%9Bjuneshellaboutromania%20XXXV%20Fm%20IxbcbxRxg7%2B%202%20131%20%25%F0%9F%8C%94%F0%9F%90%94%F0%9F%8F%8B%EF%B8%8F%E2%80%8D%E2%99%82%EF%B8%8F%F0%9F%8F%8B%EF%B8%8F%E2%80%8D%E2%99%82%EF%B8%8F%F0%9F%8F%8B%EF%B8%8F%E2%80%8D%E2%99%82%EF%B8%8F%20%28.%29%28.%29%20i%20am%20enoughhttps%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3De3h3exBxTKs%231daebe%2011%3A20

encoded html

data:text/html;charset=utf-8;base64,PGRpdiBkYXRhLXYtMWFkMWUwZTA9IiIgY2xhc3M9IlByb3NlTWlycm9yIHBhc3N3b3JkLWZpbmFsIj48cD7wn5Cb8J+QmzxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDI4cHgiPjxlbT5qPC9lbT48c3Ryb25nPnU8L3N0cm9uZz48ZW0+bjwvZW0+PHN0cm9uZz5lPC9zdHJvbmc+PGVtPnNoPC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBNb25vc3BhY2U7IGZvbnQtc2l6ZTogMTJweCI+PHN0cm9uZz5lPC9zdHJvbmc+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDI4cHgiPjxlbT5sPC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBNb25vc3BhY2U7IGZvbnQtc2l6ZTogMjVweCI+PGVtPmw8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IE1vbm9zcGFjZTsgZm9udC1zaXplOiAyOHB4Ij48c3Ryb25nPmE8L3N0cm9uZz48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBNb25vc3BhY2U7IGZvbnQtc2l6ZTogMzJweCI+PGVtPmI8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IE1vbm9zcGFjZTsgZm9udC1zaXplOiAyOHB4Ij48c3Ryb25nPm88L3N0cm9uZz48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBNb25vc3BhY2U7IGZvbnQtc2l6ZTogMjVweCI+PHN0cm9uZz51PC9zdHJvbmc+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDI4cHgiPnRyPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDI1cHgiPjxzdHJvbmc+PGVtPm88L2VtPjwvc3Ryb25nPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IE1vbm9zcGFjZTsgZm9udC1zaXplOiAyOHB4Ij48ZW0+bTwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDI1cHgiPjxzdHJvbmc+PGVtPmE8L2VtPjwvc3Ryb25nPjxlbT5uPC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBNb25vc3BhY2U7IGZvbnQtc2l6ZTogMjhweCI+PHN0cm9uZz48ZW0+aTwvZW0+PC9zdHJvbmc+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDMycHgiPjxzdHJvbmc+PGVtPmE8L2VtPjwvc3Ryb25nPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IE1vbm9zcGFjZTsgZm9udC1zaXplOiAyNXB4Ij48ZW0+IDwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogVGltZXMgTmV3IFJvbWFuOyBmb250LXNpemU6IDI4cHgiPjxlbT5YPC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBUaW1lcyBOZXcgUm9tYW47IGZvbnQtc2l6ZTogMjVweCI+PGVtPlg8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFRpbWVzIE5ldyBSb21hbjsgZm9udC1zaXplOiAzMnB4Ij48ZW0+WDwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogVGltZXMgTmV3IFJvbWFuOyBmb250LXNpemU6IDI4cHgiPjxlbT5WIEY8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFRpbWVzIE5ldyBSb21hbjsgZm9udC1zaXplOiA0MnB4Ij48ZW0+bTwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogVGltZXMgTmV3IFJvbWFuOyBmb250LXNpemU6IDI4cHgiPjxlbT4gPC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBUaW1lcyBOZXcgUm9tYW47IGZvbnQtc2l6ZTogNDJweCI+PHN0cm9uZz48ZW0+STwvZW0+PC9zdHJvbmc+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDQycHgiPjxlbT54YjwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDI4cHgiPjxlbT5jPC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBNb25vc3BhY2U7IGZvbnQtc2l6ZTogMjVweCI+PGVtPmI8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IE1vbm9zcGFjZTsgZm9udC1zaXplOiAzNnB4Ij48ZW0+eDwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDI1cHgiPjxlbT5SPC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBNb25vc3BhY2U7IGZvbnQtc2l6ZTogMTJweCI+PGVtPng8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IE1vbm9zcGFjZTsgZm9udC1zaXplOiAyOHB4Ij48ZW0+ZzwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDQ5cHgiPjc8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBNb25vc3BhY2U7IGZvbnQtc2l6ZTogMjhweCI+KyA8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBNb25vc3BhY2U7IGZvbnQtc2l6ZTogNHB4Ij4yPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDlweCI+IDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAxcHgiPjxzdHJvbmc+PGVtPjE8L2VtPjwvc3Ryb25nPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiA5cHgiPjxzdHJvbmc+PGVtPjM8L2VtPjwvc3Ryb25nPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAxcHgiPjxzdHJvbmc+PGVtPjE8L2VtPjwvc3Ryb25nPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IE1vbm9zcGFjZTsgZm9udC1zaXplOiAyOHB4Ij4gJfCfjJTwn5CUPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDI4cHgiPvCfj4vvuI/igI3imYLvuI/wn4+L77iP4oCN4pmC77iP8J+Pi++4j+KAjeKZgu+4jyAoLikoLikgPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDI1cHgiPjxzdHJvbmc+aTwvc3Ryb25nPjwvc3Bhbj4gPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBNb25vc3BhY2U7IGZvbnQtc2l6ZTogMTZweCI+PHN0cm9uZz5hPC9zdHJvbmc+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDI1cHgiPjxlbT5tPC9lbT48L3NwYW4+IDxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogTW9ub3NwYWNlOyBmb250LXNpemU6IDE2cHgiPjxzdHJvbmc+ZTwvc3Ryb25nPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IE1vbm9zcGFjZTsgZm9udC1zaXplOiAzMnB4Ij48ZW0+bjwvZW0+PHN0cm9uZz5vdTwvc3Ryb25nPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IE1vbm9zcGFjZTsgZm9udC1zaXplOiAyNXB4Ij48ZW0+Z2g8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAzMnB4Ij48ZW0+aDwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDI1cHgiPjxlbT50PC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBXaW5nZGluZ3M7IGZvbnQtc2l6ZTogMzJweCI+PGVtPnQ8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAyOHB4Ij48ZW0+cDwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDI1cHgiPjxlbT5zPC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBXaW5nZGluZ3M7IGZvbnQtc2l6ZTogMjhweCI+PGVtPjovL3c8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAyNXB4Ij48ZW0+dzwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDMycHgiPjxlbT53PC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBXaW5nZGluZ3M7IGZvbnQtc2l6ZTogMjhweCI+PGVtPi48L2VtPjxzdHJvbmc+eTwvc3Ryb25nPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAxNnB4Ij48c3Ryb25nPm91PC9zdHJvbmc+dDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAzNnB4Ij48c3Ryb25nPnU8L3N0cm9uZz48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBXaW5nZGluZ3M7IGZvbnQtc2l6ZTogMTZweCI+Yjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiA0OXB4Ij48c3Ryb25nPmU8L3N0cm9uZz48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBXaW5nZGluZ3M7IGZvbnQtc2l6ZTogMjhweCI+Ljwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAyNXB4Ij5jPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDM2cHgiPjxzdHJvbmc+bzwvc3Ryb25nPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAzMnB4Ij48ZW0+bTwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDI4cHgiPi88L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBXaW5nZGluZ3M7IGZvbnQtc2l6ZTogMTZweCI+dzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiA0MnB4Ij48c3Ryb25nPmE8L3N0cm9uZz48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBXaW5nZGluZ3M7IGZvbnQtc2l6ZTogMzZweCI+PGVtPnQ8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAzMnB4Ij48ZW0+YzwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDE2cHgiPjxlbT5oPC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBXaW5nZGluZ3M7IGZvbnQtc2l6ZTogMjhweCI+PGVtPj88L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAyNXB4Ij48ZW0+djwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDI4cHgiPjxlbT49PC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBXaW5nZGluZ3M7IGZvbnQtc2l6ZTogNjRweCI+PHN0cm9uZz48ZW0+ZTwvZW0+PC9zdHJvbmc+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDlweCI+PGVtPjM8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAxMnB4Ij48ZW0+aDwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDlweCI+PGVtPjM8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiA0cHgiPjxzdHJvbmc+PGVtPmU8L2VtPjwvc3Ryb25nPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiA5cHgiPjxlbT54PC9lbT48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBXaW5nZGluZ3M7IGZvbnQtc2l6ZTogMTJweCI+PGVtPkI8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiA0OXB4Ij48ZW0+eDwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDEycHgiPjxlbT5US3M8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAyOHB4Ij48ZW0+IzwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDFweCI+PGVtPjE8L2VtPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAyOHB4Ij48ZW0+ZDwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDQ5cHgiPjxzdHJvbmc+PGVtPmE8L2VtPjwvc3Ryb25nPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAzNnB4Ij48c3Ryb25nPjxlbT5lPC9lbT48L3N0cm9uZz48ZW0+YjwvZW0+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDlweCI+PHN0cm9uZz48ZW0+ZTwvZW0+PC9zdHJvbmc+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDQycHgiPjxzdHJvbmc+PGVtPiA8L2VtPjwvc3Ryb25nPjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IFdpbmdkaW5nczsgZm9udC1zaXplOiAxcHgiPjxzdHJvbmc+PGVtPjExPC9lbT48L3N0cm9uZz48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBXaW5nZGluZ3M7IGZvbnQtc2l6ZTogNDJweCI+PHN0cm9uZz48ZW0+OjwvZW0+PC9zdHJvbmc+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDRweCI+PHN0cm9uZz48ZW0+MjwvZW0+PC9zdHJvbmc+PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogV2luZ2RpbmdzOyBmb250LXNpemU6IDBweCI+PHN0cm9uZz48ZW0+MDwvZW0+PC9zdHJvbmc+PC9zcGFuPjwvcD48L2Rpdj4K

(rule 34 not skipped)

Nope.

I'm stuck at level 28 where I have to convert the image to hexadecimal which I have done using multiple websites all getting the same answer however when I copy it over to the game it doesn't work. Please help I've spent too long doing this

Played with my girlfriend and we got to rule 35, include the current time

The digits in your password must add up to 25 wath do they mean with this?

1234564 = 1+2+3+4+5+6+4 = 25

Reply on news.ycombinator.com