Always have a comma in your password, if part of a leak it will break the CSV

https://toot.cafe/@codepo8/113197626186361512

by edward • 2 years ago

77 48 2 years ago

emedchill• 2 years ago

Having special characters is a good idea but having a comma just to break a CSV is dumb. This would only happen if the hacker used a bad exporter or created their own (very poorly).

freedomben• 2 years ago

Yeah, this is silly. Pretty much every serializer in existence is going to handle this case. If the attacker wrote their own, then you might get lucky

aeonik• 2 years ago

AFAIU CSV is fundamentally ambiguous and can't actually be parsed in a fully deterministic way.

Edge cases get hard when dealing with nested commas, and there's no standard escape sequence.

Probably matters less with a two column arrangement, but things get really hairy really fast when you start adding types or BLOBs in the CSV.

transfire• 2 years ago

Use quotes too then!

fsckboy• 2 years ago

","

break it, but not in a way that throws a parse error

qrios• 2 years ago

What about \""\t\n"?

hackeraccount• 2 years ago

Have you ever used quotes in a password. I did. IOS was constantly changing quotes into smart quotes. Super annoying for those times when I had to actually type in my password.

Asraelite• 2 years ago

On the other hand, if you go out of your way to pollute the data and the hacker debugs the resulting errors and finds you as the culprit, they may target you as a form of petty revenge.

teruakohatu• 2 years ago

In R, libraries will often tell you when there is a parsing anomaly and which line it occurs with. The first thing I do is examine those lines closely!

accra4rx• 2 years ago

comma being a very common and probably common when many organization are enforcing special character policy . For those big exports , they are probably not dumping out as csv , it would be light weight db file . I assume sqllite

c22• 2 years ago

This is why all my passwords have '); drop table passwords; somewhere in there.

itscrush• 2 years ago

Yea good assumption, SQLMap for instance, defaults --dump to .csv with sqlite as an option if you're just looking for a simpler test point. Plenty of other tooling options out there too. Tooling providing your encoding during dump will overcome the ',' concern though, no?

[]https://highon.coffee/blog/sqlmap-cheat-sheet/#sqlmap-dump-d...

AStonesThrow3• 2 years ago

I alternate between infrared and ultraviolet salts to foil rainbow tables

brokenmachine• 2 years ago

What does that mean?

E39M5S62• 2 years ago

https://en.wikipedia.org/wiki/Salt_%28cryptography%29

TrapLord_Rhodo• 2 years ago

They are kinda trolling, Kinda not. A rainbow table is just a huge list of precomputed passwords to hash.

MD5 hash of "pass": 1a1dc91c907325c69271ddf0c944bc72

SHA-1 hash of "pass": d74db87a56f6d8a52ca4bbafc86a27f4b66c58a4

SHA-256 hash of "pass": 3f5d8cc9ea971f85b91fe9a761e29f882abeae92e4b99b5678f7bf3f53b1519f

but if you add "salt" to the password, (i.g. some randomly generated data), your password will be deterministically unqiue, and thus a rainbow table wouldn't ever work. The infrared and ultraviolet part is pure troll tho.

anotherhue• 2 years ago

Any purple salt will be immune as it's not found in the rainbow.

naikrovek• 2 years ago

Any competent CSV parser will see straight through that.

eps• 2 years ago

It's to force simplistic dumpers produce invalid CSVs.

more_corn• 2 years ago

But can’t the hacker just write a small function to fix that? If I found a comma in the third position in a hash crack I might assume it’s part of the password and not a column separator.

kibibu• 2 years ago

Alternatively, include mojibake in your passwords so attackers think they have a unicode encoding bug

atVelocet• 2 years ago

In case anyone else doesn’t know mojibake: https://en.wikipedia.org/wiki/Mojibake

iknowstuff2• 2 years ago

i’m surprised a link to a toot which is just an incorrect meme no longer than the title of the submission itself would get upvoted here

amatecha• 2 years ago

The HN title is 77 chars, the linked post is 98 chars. If you're going to criticize something about the post at least be correct in your assertions :P

kotaKat• 2 years ago

77, 98 - what's the difference when you write 135 complaining about it? ;)

iknowstuff2• 2 years ago

how dare you

bitbasher• 2 years ago

I prefer to use zero-width joiners in my passwords and usernames to really give db dumpers a fun time.

kmoser• 2 years ago

Include a few control characters for good measure.

lazide3• 2 years ago

In my experience, nothing says fun times in a data dump like null ‘characters’!

jb1991• 2 years ago

Hackers will often dox someone they are very annoyed with, and it sounds like this is a good bait for that.

pavo-etc• 2 years ago

Seeing posts linked to my little mastodon instance is feels so strange, in a good way

kazinator2• 2 years ago

The reason you might want to put such character in a password is not in case it might leak, but in order to break the idiotic system which stores and handles those passwords in plain text. I would use a double quote and a single quote. That will break things if passwords are wrapped in quotes without escaping.

AStonesThrow3• 2 years ago

PRO TIP: You can also use % to punish incorrect use of printf(3), $ to punish use of "eval" in Perl and bash, <> to break HTML parsing, * to punish overzealous filename globbing, & to set off forkbombs on the unsuspecting victims, +++ATH0 to make their modems hang up, and ! to prevent transmission via UUCP.

kazinator2• 2 years ago

And then back into a corner, splash a can of paint in every direction, put your head between your knees, and wait for WWIII. (If it doesn't start by the time the paint dries, do it all over again tomorrow.)

rufus_foreman• 2 years ago

Always drive a stick shift, no young person will be able to steal your car.

jamesfinlayson• 2 years ago

True - a friend of mine worked in a dangerous part of the world and was car-jacked in a manual car. As soon as the car-jacker was behind the wheel they realised they couldn't drive the car and gave up.

DowsingSpoon• 2 years ago

My brother had a stick shift. Kids broke into his car and proceeded to drive it 15 feet into a pole and abandon it. Whole thing was caught on camera too.

syndicatedjelly• 2 years ago

Always pull the fuel pump fuse before leaving your car, then no one can ever even drive your car.

doubled112• 2 years ago

I had a friend who's clutch switch failed. Like most cars, it wouldn't start because it couldn't detect that you'd depressed the clutch.

He added a toggle switch under the dash instead of fixing the clutch switch. He figured it'd be some poor man's anti theft.

I think it would have worked. It was pretty fun having friends try to move his car for a while.

mariusor• 2 years ago

I always use both a comma and a semicolon. Just to cover more bases.

boffinAudio• 2 years ago

I like to have some variation of ":(){ :|:& };:" in most of my metadata somewhere ..

jpl56• 2 years ago

HN and Toot look robust, considering all the comments with separator examples. Perhaps some comments were detected and rejected.

solarkraft• 2 years ago

These people will be shocked to learn about escaping

Always have a comma in your password, if part of a leak it will break the CSV

Related Stories