Hacker News Reader

Comment by Scarblac | Hacker News Reader

Almost, the password is ********.

I love each and every one of you who have posted into this subtree, although it's bittersweet if bash.org really is going away… <3

https://archive.is/0y1yT is the archive of http://www.bash.org/?244321

FIY, your archive link is not working too at the moment.

What do we do?

Sigh

I put on my robe and wizard hat

https://web.archive.org/web/20190228221758/http://www.bash.o...

Works for me. Do note that archive.is blocks CloudFlare DNS.

Works for me now too, probably the server was not handling the load.

This has bitten me before; now my pihole has this line in its dnsmasq configuration

      server=/archive.is/archive.ph/8.8.8.8

so that even if I'm using cloudflare dns for everything else, it will query 8.8.8.8 for those two domains

This hack needs to be pinned to the front of HN :)

Seriously. I’ve been hitting this for months.

Gonna go out on a limb and agree with the archive.is owner -- the reason he blocks it is bc cloudflare intentionally doesn't support edns client subnet. They cite privacy reasons, but it comes at the at the cost of performance -- most cdns use DNS based routing, so using cloudflare DNS means you connect to random server for a lot of websites. CloudFlare on the other hand uses anycast routing for their CDN, so they don't suffer at all.

I hate Google but my pihole is configured to use their DNS resolvers. Lesser of two evils.

It shouldn't be that bad, CloudFlare's anycast should direct you to a nearby resolver, and doing your GeoDNS on that resolver IP instead of ECS is probably not that much worse than doing it on the actual client IP. Both approaches aren't great at picking an ideal CDN node, GeoIP is notoriously unreliable, and it tells you nothing about network topology.

Breaking DNS entirely is much worse behaviour, especially because GeoDNS itself is arguably not in the spirit of DNS which is distributing a consistent database, not making it up on the fly based on the client's info. The archive.is admin is being ridiculous, the least they could do is block anyone not using a resolver supporting ECS to be consistent, but no they have something personal against Cloudflare.

Indeed, over the years a symbol gets added for length/complexity/rotation purposes.

chef's kiss

Hey, how did you get my Hacker News password?

> Hey, how did you get my Hacker News password?

Relax, they didn't. Your password is 3 characters longer.

I can't read it. pfft

That's because of the HN security. It prints all passwords as stars.

You can try putting your HN password in a comment, it would be visible only by you, and the others will not see it.

hunter1

Close.

hunter2

Wait, how did you see my password?

we see it as asterisks ... you see it as hunter2 and not **** 'cos it's your password

What? I just see stars

Get to a doctor!

What? I just see stars

Have you seen a doctor?

No, just stars

Ready when you are, Raul.

How about ****** Did it work?

Oh wow, you kiss your mother with that mouth?

I use my fingers to type passwords and ehh...

I guess you're right. My HN password is *****.

When I edit, I can see it, but when I save the comment, it becomes starred. It even randomizes the length every time I save.

Brilliant!

But this also means that they know your plaintext password, meaning that they're saving passwords in plaintext. Given that this is mostly a technical community, it's much more the risk of keeping a database of plaintext passwords than the benefit of being able to obfuscate passwords in comments.

EDIT: thanks to another commenter, I understood that what's happening in the above comments is just a meme and HN isn't storing plaintext passwords. Sorry for the misunderstanding.

In case you're unclear why your being down voted, comment chain is a riff on one of the more famous bash.org quotes: https://knowyourmeme.com/memes/hunter2.

HN does not actually know your password or hide it in comments.

(whistles softly as he changes password from a string of twelve asterisks to ******)

> HN does not actually know your password or hide it in comments.

Does it not know? What if I post it in this comment? My password is *****.

What actually happens is more complex: when you type a *******, HN tries to log in once for every string in your *******, and then when it succeeds it goes back and replaces that string with a randomized length of asterisks.

(sticking with the obliviousness for a moment,) Would they need to store the plaintext password? Hashing every word typed isn't efficient but it's possible to achieve without knowing the plaintext.

It reminds me of Facebook allowing login even when you've mistyped your password: https://security.stackexchange.com/questions/214814/why-can-...

Yes, that's true. But since HN is famously hosted on a single not-so-powerful server, that would be unlikely to be the employed solution.

Considering how laggy the comment box is on reddit, it makes me wonder if they're not already doing something similar, but client-side in js. I guess it would expose the salt though.

Exposing the salt isn't an issue, it can (and should) even be a different one for each account.

> Hashing every word typed

Wouldn’t work if your password contains spaces.

But it does! They, instead, hash each letter independently, that's how they can do this.

They just hash every substring that can be a password.

Don't write long comments. Show some love to HN's server carrying its O(n^2) burden.

I love that some 20-30 years after that famous chat somebody still fell for it.

*****? That's amazing! I've got the same password on my luggage!

This has to be a joke.

The only way it can be realistically implemented involves the storage of clear-text user password to enable string replacement during comment submission. Either that or converting user comment to a prefix/suffix table (or something similar) and then hash each item to search for a match. Both option is ridiculously unnecessary.

Anyway, my HN password is ****. I bet it don't work.

Fortunately with modern serverless architecture, it's possible to make this performant! Just split up each comment into words and dispatch each word to a queue where AWS Lambda workers can check the words against the user's password hash. It might cost $20 to process each comment, but at least it'll autoscale to handle any comment volume you throw at it!

Can passwords include spaces?

Reply on news.ycombinator.com