There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

lemmy.world

todd_bonzalez , to lemmyshitpost in Kids and their computers these days.

Wild that we let a person cover their vehicle with signs that essentially say “I have severe untreated mental illness and no grip on reality”, and society at large says “sure, keep operating that heavy machinery in public”.

ArbitraryValue ,

What’s the alternative? Locking up people who haven’t committed a crime if a doctor doesn’t like what they’re saying? This guy probably is schizophrenic but plenty of conspiracy theorists aren’t and people saying something true but unpopular sometimes sound like conspiracy theorists.

todd_bonzalez ,

I said we shouldn’t let them drive a car, not lock them in prison. Calm down.

Ideally we would provide people like this with mental healthcare, and get them medicated so that they actually can operate a vehicle without being an inherent risk to everyone around them.

My point is that, in America, you can basically be screaming “I am extremely unwell to the point of being an elevated risk to myself and everyone around me”, and our usual response is to act like everything is normal and nothing should be done.

ArbitraryValue ,

I don’t think this guy would take any pills you tried to give him unless you literally forced them down his throat. (They’re created with computer too.)

rudyharrelson ,

(They’re created with computer too.) I’ve got bad news for him regarding how modern pickup trucks work.

_stranger_ ,

One of those signs says please spread this on the Internet. Person has a grasp on that, so it seems to me they’re basically accepting the “risk” to spread the “truth”.

Ilovethebomb ,

That is definitely not a modern pickup truck they’re driving though.

rudyharrelson ,

I’m no expert on automobiles, but that truck would need to be 40+ years old to have no computers onboard. It doesn’t look that old to me, though maybe he just kept it in good shape.

Ilovethebomb ,

It’s honestly hard to tell, because even a brand new equivalent vehicle would look very similar from the side. Pickup trucks haven’t changed visually much over the years.

todd_bonzalez ,

Again, my point is that we need to stop coming up with excuses for doing nothing, but go ahead and list another excuse.

yemmly , (edited )

Mental healthcare is currently unavailable as we wait for a replacement part that is on backorder. In the meantime, please accept these sign boards and this extra large sharpie for the inconvenience.

ArbitraryValue ,

What do you propose doing when this guy refuses to take his medication?

RizzRustbolt ,

I think art therapy would work better than medication in this case.

(Also, taking away someone’s driver license is tantamount to imprisonment in modern America.)

PM_ME_VINTAGE_30S ,
@PM_ME_VINTAGE_30S@lemmy.sdf.org avatar

“I have severe untreated mental illness and no grip on reality”

(Emphasis mine)

That is a vast oversimplification of how people work. It is absolutely plausible to me that someone might believe obvious lies but is otherwise qualified to drive heavy machinery. Analyzing the society you live in is a totally different skill than driving.

For example, if I found out my bus driver literally believes that reptilians run the world, I would still trust them to drive my bus because driving a bus has nothing to do with lizard people. Conversely, I wouldn’t trust a bus driver who agrees with everything I believe in but is currently having a panic attack.

This is important to me because I am mentally ill (treated, but mentally ill nonetheless) and autistic (which is treated like a mental illness), and this is the kind of logic that tyrants use to manufacture popular consent to further marginalize mentally ill people.

todd_bonzalez ,

Look, I understand the line you are trying to walk here, but encountering a vehicle like this and thinking “this guy just has different ideas than me, but is otherwise trustworthy” is not rational thinking.

There’s a difference between believing in conspiracy theories and covering your van with warnings about the nanochips on your body that give you computer generated diseases.

If I learned that someone suffering extreme paranoid delusions like this were in charge of operating a passenger vehicle, I would be extremely concerned with the safety of those passengers.

This isn’t some unreasonable thing. I have a lot of compassion for those who suffer from mental illness, but I also think that public safety should take precedent when it is clear that someone is mentally incapable of being trusted with things like heavy machinery.

It’s not the ideas expressed on this vehicle that concern me. It’s that every part of this indicates a serious and untreated mental health problem. The only way my opinion could be redeemed is if the owner of the van came forward and said it was a joke, or a prop for a movie or something, because nobody with a connection to reality is going to write those things all over a truck and parade around town trying to spread the word if they aren’t severely dissociated from reality.

And I cannot stress this enough, nothing about this story has anything to do with Autism. Paranoid delusions are not a typical issue for Autistic people.

PM_ME_VINTAGE_30S ,
@PM_ME_VINTAGE_30S@lemmy.sdf.org avatar

And I cannot stress this enough, nothing about this story has anything to do with Autism. Paranoid delusions are not a typical issue for Autistic people.

Agreed, but I am autistic and I have had this language used against me to argue why I shouldn’t be allowed to make my own decisions. I.e., it is a popular misconception and form of rhetoric that autistic people have paranoid delusions because we perceive the world differently. I brought it up because I’m arguing from my lived experience as a mentally ill and autistic person, i.e. I’m not just being an internet contrarian.

I did not mean to imply that autistic people typically do suffer from paranoid delusions. However, (at least in my view) we do suffer from neurotypical people believing we suffer from paranoid delusions.

encountering a vehicle like this and thinking “this guy just has different ideas than me, but is otherwise trustworthy” is not rational thinking.

I don’t have to find someone completely trustworthy in order for them to be an acceptable driver. Actually, I typically don’t fully trust the people I get in cars with. I only need to trust them enough to know that they’re not going to veer into traffic, they’re going to drive reasonably, and that they will take me to the place we promised to go. I think that the kinds of decisions that go into driving are completely different from those that drive a person to mark up their car.

Look, I understand the line you are trying to walk here

Yeah, I am trying to “walk a line” here and I think I understand where you’re coming from, so I’m absolutely willing to agree to disagree.

todd_bonzalez ,

I’m absolutely willing to agree to disagree.

This is called a “Thought-terminating cliche”, specifically this one: I’m entitled to my opinion

“Where an objection to a belief is made, the assertion of the right to an opinion side-steps the usual steps of discourse of either asserting a justification of that belief, or an argument against the validity of the objection. Such an assertion, however, can also be an assertion of one’s own freedom from, or a refusal to participate in, the rules of argumentation and logic at hand.”

So, unlike you, I am not willing to “agree to disagree”, because this is an intellectually bankrupt position. You are overreacting to concerns regarding schizophrenic people and being irrational because of a personal concern about perceptions of Autistic people, despite nobody saying anything about Autism (but you).

I am also on the spectrum, and I wish you would think before you drag Autism into this conversation, because Autistic people like us don’t do crazy shit like this.

Fizz ,
@Fizz@lemmy.nz avatar

The guy driving this van is probably about as functional as someone in the middle of a panic attack. Very likely erratic and on meth I would not trust to drive.

PM_ME_VINTAGE_30S ,
@PM_ME_VINTAGE_30S@lemmy.sdf.org avatar

The guy driving this van is probably about as functional as someone in the middle of a panic attack. Very likely erratic

I would have to talk to them first (or watch them drive if I’m in traffic) to see if that actually is the case, just like I would if the person’s car was clean.

Etterra ,

If you’re a crazy enough that this makes sense, I don’t think you should be driving a vehicle even if you’re technically capable of doing so. At least not until you get diagnosed and treated.

PM_ME_VINTAGE_30S ,
@PM_ME_VINTAGE_30S@lemmy.sdf.org avatar

I know this is a shitposting sub but this is the exact kind of comment I’m pushing back against. No, I do not deserve to lose my driving privileges because I believe that people with paranoid delusions may be safe to drive.

Ilovethebomb ,

There’s a big difference between a danger that is tangible and immediate, such as a collision with another vehicle, and something that cannot be seen or interacted with, like electricity or a virus.

There’s nothing about this that tells me this person can’t drive safely.

Sir_Fridge , (edited )

So where I live if you have a disease, physical or mental, you go to a doctor and they decide if you’re ok to drive or if you need to pass an extra test first where you are judged if you’re able to drive safely with whatever disabilities you have. This is besides the standard driving test and written test. Also everybody has to take lessons with a professional.

It’s however not perfect because the government doesn’t have access to your medical records (which is good). But that means you have to be honest on a form about your disabilities. Plus the doctor visit is not covered by insurance and costs around 200 euros.

Plus if you already have your licence there isn’t really a system in place to prevent you for driving if your health declines.

Freefall ,

I just blink my nictating membranes at them and carry on with my powerful government job.

lazynooblet , to foodporn in Homemade BLTs and Fried Mushrooms 🥓🥬🍅🍄🍻
@lazynooblet@lazysoci.al avatar

I could maybe manage half of one sandwich. Is this a meal for a family of 4?

deepdivedylan OP ,
@deepdivedylan@lemmy.world avatar

Even worse: I have kitties to feed! 😻😹😺🐾

umbraroze , to lemmyshitpost in Look you've just to got read the prologue that was a limited edition IHOP giveaway in 2015 and the story is awesome

Oh, but the power of American superhero comics is that you can just start reading them wherever. Sure, there is deeper lore, but you’re not required to know all that. There’s this bat-dude, see? He punches crooks and does awesome shit in the night. There’s also a bunch of wacky villains. See? Just go read it, you’ll pick up the rest of the details as you go along!

And I also love a lot of European comics because most often they have a pretty good balance between complex writing and manageable size. And publishers here tend to be more lenient toward artists making one-shot kind of comics, without any expectations that it’ll become the next endless blockbuster cash-cow property.

Still, I do like how most of the manga series are like “OK, here’s the beginning, here’s 20 or whatever volumes, here’s the end.”

Zoomboingding ,
@Zoomboingding@lemmy.world avatar

Why do people understand this about the comics but not the movies?

superkret , to greentext in Anon is asking the difficult questions

I married #2

BackOnMyBS ,
@BackOnMyBS@lemmy.autism.place avatar

Thank you for your service: one less #2 out of the market to tempt us.

Wanderer , (edited ) to greentext in Anon is asking the difficult questions

No matter how hot a woman is someone somewhere is tired of her shit.

Option 2. Don’t have kids break up with her. Be happy about it, thank God it is finally over. Then think back on how great the sex was and miss her for the rest of your life.

BackOnMyBS ,
@BackOnMyBS@lemmy.autism.place avatar

No matter how hot a woman is someone somewhere is tired of her shit.

This is 100% true. Not only that, but the more hot a woman is, the less she’s had to develop a loving personality and skills. I’ve gotten to the point that I won’t even consider dating anything above a 7 anymore. Those are just traps. I’d like a nice 6-7 with some hobbies, quirks, and skills pls. She would be my 10.

frezik , to lemmyshitpost in Look you've just to got read the prologue that was a limited edition IHOP giveaway in 2015 and the story is awesome

Star Trek '09 and Into Darkness are both better movies if you read their supplementary comics. This is, I think, already on bad ground. Each work should be able to stand on its own to some degree. Pushing supplementary stuff like this to bring the story together is a cynical cash grab.

Season 1 of Picard then directly contradicts the comic to '09. Specifically, Data was fully revived inside B4 in the comic, while Picard showed that B4 could never handle the complexity of Data’s programming (which, admittedly, is the more likely outcome). Not only that, but Alex Kurtzman was one of the writers of the comic was also on the writing team of Picard. Erasing that plot point was a deliberate choice.

Where does that leave us with those comics?

Cowbee , to memes in Silver lining
@Cowbee@lemmy.ml avatar

The world overall is on a positive trend as the American Empire declined, hopefully its collapse won’t be as disastrous as it has set itself up to be though.

cuerdo OP ,

Q. Is it not obvious to anyone that the Empire is as strong as it ever was?

A. The appearance of strength is all about you. It would seem to last forever. However, Mr. Advocate, the rotten tree-trunk, until the very moment when the storm-blast breaks it in two, has all the appearance of might it ever had. The storm-blast whistles through the branches of the Empire even now. Listen with the ears of psychohistory, and you will hear the creaking.

Q. (uncertainly) We are not here, Dr. Seldon, to lis

A. (firmly) The Empire will vanish and all its good with it. Its accumulated knowledge will decay and the order it has imposed will vanish. Interstellar wars will be endless; interstellar trade will decay; population will decline; worlds will lose touch with the main body of the Galaxy. �And so matters will remain.

paultimate14 , to greentext in Anon is asking the difficult questions

Both of these guys are going to remain single or, at best, in toxic relationships until they change their approach to both women and relationships.

stress_headache , to lemmyshitpost in Kids and their computers these days.

This guy will be a US Congressman in 2 years.

LazaroFilm , to memes in Just not his thing.
@LazaroFilm@lemmy.world avatar

“Is this still available?”

Steamymoomilk ,

It now has 2 slices missing You took to long to buy it

LazaroFilm ,
@LazaroFilm@lemmy.world avatar

Is this still available?

Arghblarg , to linuxmemes in Windows 12
@Arghblarg@lemmy.ca avatar

Don’t let your guard down. Maybe this time they’ll fully pull the TPM/UEFI trigger and make it impossible to install any other OS on new PCs… they have lots of leverage over manufacturers to tighten the screws on the BIOS and boot process.

jmcs ,

The European Commission would appreciate the multi billion euro “donation” from Microsoft if they did something so obviously anti competitive.

DetectiveKakuna ,

I agree, but also when has a threat of a fine ever stopped a capitalist from doing what they want? They just call it the cost of doing business.

Draegur , to linuxmemes in Tough choice

I’M GONNA PET THE PUPPIES :D

and feed them ._.

IronKrill , to linuxmemes in Tough choice

Logically speaking, I would sit with the wolf pack. Airline seatbelts are not made for wolves and I fully believe they would not be held by such paltry restraints. This leads me to the conclusion that my demise is not only certain, but an inevitability. With this in mind I would much rather be the first victim, for my death will be quicker while they are hungrier, and I shall save myself the mental trauma of seeing them devour the poor linux user before I reach my untimely end.

Live_your_lives ,

Umm, akshually, there would be a number of options to try first, depending on the circumstances:

  • never get on in the first place
  • the bathroom or the cockpit
  • an emergency door
  • threaten whoever is forcing you into this mess in the first place so that they hopefully put you to an even quicker end.
southsamurai , to greentext in Anon is asking the difficult questions
@southsamurai@sh.itjust.works avatar

Pfft, reject the entire thing. Be patient, find someone that’s compatible. It isn’t like you have to settle right now.

slazer2au , to linuxmemes in -----BEGIN PRIVATE KEY-----

I wonder if you string together enough words can it be a valid key?

cm0002 ,

I would hope so, sentences and words are some of the most secure passwords/phrases you can use

https://lemmy.world/pictrs/image/71426e32-a0e3-450a-9e84-be198e2b3144.png

bjorney , (edited )

Words are the least secure way to generate a password of a given length because you are limiting your character set to 26, and character N gives you information about the character at position N+1

The most secure way to generate a password is to uniformly pick bytes from the entire character set using a suitable form of entropy

Edit: for the dozens of people still feeling the need to reply to me: RSA keys are fixed length, and you don’t need to memorize them. Using a dictionary of words to create your own RSA key is intentionally kneecapping the security of the key.

laurelraven ,

That’s only really true if you’re going to be storing the password in a secure vault after randomly generating it; otherwise, it’s terrible because 1) nobody will be able to remember it so they’ll be writing it down, and 2) it’ll be such a pain to type that people will find ways to circumvent it at every possible turn

Pass phrases, even when taken with the idea that it’s a limited character set that follows a semi predictable flow, if you look at it in terms of the number of words possible it actually is decently secure, especially if the words used are random and not meaningful to the user. Even limiting yourself to the 1000 most common words in the English language and using 4 words, that’s one trillion possible combinations without even accounting for modifying capitalisation, adding a symbol or three, including a short number at the end…

And even with that base set, even if a computer could theoretically try all trillion possibilities quickly, it’ll make a ton of noise, get throttled, and likely lock the account out long before it has a chance to try even the tiniest fraction of them

Your way is theoretically more secure, but practically only works for machines or with secure password storage. If it’s something a human needs to remember and type themselves, phrases of random words is much more viable and much more likely to be used in a secure fashion.

bjorney ,

We are talking about RSA though, so there is a fixed character length and it isn’t meant to be remembered because your private key is stored on disk.

Yes the word method is better than a random character password when length is unbounded, but creating secure and memorable passwords is a bit of an oxymoron in today’s date and age - if you are relying on remembering your passwords that likely means you are reusing at least some of them, which is arguably one of the worst things you can do.

user224 ,
@user224@lemmy.sdf.org avatar

You didn’t have to call me out like that.

laurelraven ,

Okay, that’s fair… Not sure how I missed that context but that’s totally on me

Fetus ,

Most of my passwords are based around strings of characters that are comfortable to type, then committing them to muscle memory. There’s a few downsides to this:

  • If I need to log in to something on mobile and don’t have a proper keyboard with me, it’s tough to remember which symbols I’ve used
  • I share some of my logins with friends and family for certain things, if they call and need to re-enter a password, it’s usually impossible to recite it to them over the phone (most of my shared logins have reverted back to proper words and numbers to make it easier for the others)
  • If I lose an arm, I’ll probably have to reset all of my passwords.

But yeah, words alone provide plenty of possibilities. There’s a reason cryptocurrency wallets use them for seed phrases.

ClamDrinker ,

And even with that base set, even if a computer could theoretically try all trillion possibilities quickly, it’ll make a ton of noise, get throttled, and likely lock the account out long before it has a chance to try even the tiniest fraction of them

One small correction - this just isn’t how the vast majority of password cracking happens. You’ll most likely get throttled before you try 5 password and banned before you get to try 50. And it’s extremely traceable what you’re trying to do. Most cracking happens after a data breach, where the cracker has unrestricted local access to (hopefully) encrypted and salted password hashes.

People just often re-use their password or even forget to change it after a breach. That’s where these leaked passwords get their value if you can decrypt them. So really, this is a non-factor. But the rest stands.

laurelraven ,

That’s fair

It’s still a rather large pool to crack through even without adding more than the 1000 most common words, extra digits, minimal character substitution, capitalization tweaks, etc

possiblylinux127 ,

That’s why you need lots of words. (6) If you combine that with a large word list it gets very secure.

JackbyDev ,

Good luck remembering random bytes. That infographic is about memorable passwords.

bjorney ,

You memorize your RSA keys?

sus ,

you memorize the password required to decrypt whatever container your RSA key is in. Hopefully.

bjorney ,

Sure but we aren’t talking about that

sus ,

I think this specific chain of replies is talking about that actually… though it is a pretty big tangent from the original post

bjorney ,

“can you string words to form a valid RSA key”

“Yes this is the most secure way to do it”

“No, it’s not when there is a fixed byte length”

-> where we are now

sus ,

the direct chain I can see is

“can you string words to form a valid RSA key”

“I would hope so, [xkcd about password strength]”

“words are the least secure way to generate random bytes”

“Good luck remembering random bytes. That infographic is about memorable passwords.”

“You memorize your RSA keys?”

so between comments 2 and 3 and 4 I’d say it soundly went past the handcrafted RSA key stuff.

Jtotheb ,

Sounds like a good point, but claiming that “Words are the least secure way to generate a password 84 characters long” would be pointless.

sus ,

and some people will try to just hold a key down until it reaches the length limit… which is an even worse way to generate a password of that length

prole , (edited )

Edit: Oops forgot what the topic was.

bjorney ,
  1. we are talking about RSA keys - you don’t memorize your RSA keys
  2. if you rely on memorizing all your passwords, I assume that means you have ample password reuse, which is a million times worse than using a different less-secure password on every site
prole ,

Derp. Forgot where I was.

I find passphrases easy to remember and I have several. I appreciate the concern, but I understand basic password safety.

shrugs ,

so you are saying 44 bits of entropy is not enough. the whole point of the comic is, that 4 words out of a list of 2000 is more secure then some shorter password with leetcode and a number and punctuation at the end. which feels rather intuitive given that 4 words are way easier to remember

bjorney ,

No im saying if your password size is limited to a fixed number of characters, as is the case with RSA keys, words are substantially less secure

intensely_human ,

Not if you’re considering security gained versus difficulty of remembering.

bjorney ,

You don’t memorize RSA keys

raspberriesareyummy ,

you are at the same time right, but … wooosh.

intensely_human ,

character N gives you information about the character at position N+1

There is no point in a password cracking attempt during which the attacker knows the character at N but not the character at N+1

bjorney ,

If you know the key is composed of English language words you can skip strings of letters like “ZRZP” and “TQK” and focus on sequences that actually occur in a dictionary

Fillicia ,

The part where this falls flat is that using dictionary words is one of the first step in finding unsecured password. Starting with a character by character brute force might land you on a secure password eventually, but going by dictionary and common string is sure to land you on an unsecured password fast.

possiblylinux127 ,

That’d why words are from the eff long word list and there are 6 words

SatyrSack ,

Even if an attacker knew that your password was exactly four words from a specific list of only 2048 common words, that password would still be more secure than something like Tr0ub4dor&3

www.explainxkcd.com/…/936:_Password_Strength

Fillicia ,

If the attacker search for your password specifically then xkcd themself posted the reason why it wouldn’t really matter

www.explainxkcd.com/wiki/index.php/538:_Security

If you’re doing blind attemps on a large set of users you’ll aim for the least secured password first, dictionary words and known strings.

14th_cylon ,

No, it would not. 2048 to the power of 4 is significantly less than 60 to the power of 11.

[www.wolframalpha.com/input?i2d=true&i=Power2048%…

Zangoose ,

That’s true but in practice it wouldn’t take 60^11 tries to break the password. Troubador is not a random string and all of the substitutions are common ( o -> 0, a ->4, etc. ). You could crack this password a lot easier with a basic dictionary + substitution brute force method.

I’m saying this because I had an assignment that showed this in an college cybersecurity class. Part of our lesson on password strength was doing a brute force attack on passwords like the one in the top of the xkcd meme to prove they aren’t secure. Any modern laptop with an i5 or higher can probably brute force this password using something like hashcat if you left it on overnight.

Granted, I probably wouldn’t use the xkcd one either. I’d either want another word or two or maybe a number/symbol in between each word with alternating caps or something like that. Either way it wouldn’t be much harder to remember.

14th_cylon ,

Troubador is not a random string

except it is not troubador. it is troubador, ampersand, digit.

if you know there are exactly two additional characters and you know they are at the end of the string, the first number is really slightly bigger (like 11 times)

once the random appendix is 3 characters or more, the second number wins

[www.wolframalpha.com/input?i2d=true&i=DividePowe…

and moral of the story is: don’t use xkcd comic, however funny it is, as your guidance to computer security. yes, the comic suggestions are better than having the password on a post-it on your monitor, but this is 21st century ffs, use password wallet.

sus , (edited )

if you know there are exactly two additional characters

this is pretty much irrelevant, as the amount of passwords with n+1 random characters is going to be exponentially higher than ones with n random characters. Any decent password cracker is going to try the 30x smaller set before doing the bigger set

and you know they are at the end of the string

that knowledge is worth like 2 bits at most, unless the characters are in the middle of a word which is probably even harder to remember

if you know there are exactly two additional characters and you know they are at the end of the string, the first number is really slightly bigger (like 11 times)

even if you assume the random characters are chosen from a large set, say 256 characters, you’d still get the 4-word one as over 50 times more. Far more likely is that it’s a regular human following one of those “you must have x numbers and y special characters” rules which would reduce it to something like 1234567890!?<^>@$%&±() which is going to be less than 30 characters

and even if they end up roughly equal in quessing difficulty, it is still far easier to remember the 4 random words

ClamDrinker , (edited )

While this comic is good for people that do the former or have very short passwords, it often misleads from the fact that humans simply shouldn’t try to remember more than one really good password (for a password manager) and apply proper supplementary techniques like 2FA. One fully random password of enough length will do better than both of these, and it’s not even close. It will take like a week or so of typing it to properly memorize it, but once you do, everything beyond that will all be fully random too, and will be remembered by the password manager.

cheeso ,

then someone uses a dictionary attack and your password gets cracked within minutes

sus , (edited )

this assumes a dictionary is used. Otherwise the entropy would be 117 bits or more. The only problem is some people may fail to use actually uniformly random words drawn from a large enough set of words (okay, and you should also use a password manager for the most part)

shrugs ,

see, you didn’t get the whole comic. 4 words out of a dicitionary with 2000 words has more combinations then a single uncommon non gibberish baseword with numeral and puction at the end. as long as the attacker knows your method.

a dicitonary attack will not lower the entropy of 44 bits, thats what the comic is trying to say

dohpaz42 ,
@dohpaz42@lemmy.world avatar
hendrik ,

It's assymetric crypto. You'd need to find a matching public key. Or it's just some useless characters. I suppose that's impossible, or what we call that... Like take a few billion years to compute. But I'm not an expert on RSA.

slazer2au ,

Public keys are derived from the private key. The asymmetric part is for communication not generation. Afaik

hendrik , (edited )

I'm pretty sure the cryptographic parameters to generate a public key are included in the private key file. So while you can generate the other file from that file, it's not only the private part in it but also some extra information and you can't really change the characters in the private key part. Also not an expert here. I'm fairly certain that it can't happen the other way round, or you could impersonate someone and do all kinds of MITM attacks... In this case I've tried it this way, changed characters and openssh-keygen complains and can't generate anything anymore.

kamenlady ,
@kamenlady@lemmy.world avatar

The surprised man in the middle

possiblylinux127 ,

Reddit did it in reverse for Tor

ShortFuse , (edited )

Yeah, except for the first few bytes. PKCS8 has some initial header information, but most of it is the OCTET_STRING of the private key itself.

The PEM (human “readable”) version is Base64, so you can craft up a string and make that your key. DER is that converted to binary again:


<span style="font-style:italic;color:#969896;">/**
</span><span style="font-style:italic;color:#969896;"> * @see https://datatracker.ietf.org/doc/html/rfc5208#section-5
</span><span style="font-style:italic;color:#969896;"> * @see https://datatracker.ietf.org/doc/html/rfc2313#section-11
</span><span style="font-style:italic;color:#969896;"> * Unwraps PKCS8 Container for internal key (RSA or EC)
</span><span style="font-style:italic;color:#969896;"> * @param {string|Uint8Array} pkcs8
</span><span style="font-style:italic;color:#969896;"> * @param {string} [checkOID]
</span><span style="font-style:italic;color:#969896;"> * @return {Uint8Array} DER
</span><span style="font-style:italic;color:#969896;"> */
</span><span style="font-weight:bold;color:#a71d5d;">export </span><span style="color:#323232;">function privateKeyFromPrivateKeyInformation(pkcs8, checkOID) {
</span><span style="color:#323232;">  </span><span style="font-weight:bold;color:#a71d5d;">const </span><span style="color:#323232;">der </span><span style="font-weight:bold;color:#a71d5d;">= </span><span style="color:#323232;">derFromPrivateKeyInformation(pkcs8);
</span><span style="color:#323232;">  </span><span style="font-weight:bold;color:#a71d5d;">const </span><span style="color:#323232;">[
</span><span style="color:#323232;">    [privateKeyInfoType, [
</span><span style="color:#323232;">      [versionType, version],
</span><span style="color:#323232;">      algorithmIdentifierTuple,
</span><span style="color:#323232;">      privateKeyTuple,
</span><span style="color:#323232;">    ]],
</span><span style="color:#323232;">  ] </span><span style="font-weight:bold;color:#a71d5d;">= </span><span style="color:#323232;">decodeDER(der);
</span><span style="color:#323232;">  </span><span style="font-weight:bold;color:#a71d5d;">if </span><span style="color:#323232;">(privateKeyInfoType </span><span style="font-weight:bold;color:#a71d5d;">!== </span><span style="color:#183691;">'SEQUENCE'</span><span style="color:#323232;">) </span><span style="font-weight:bold;color:#a71d5d;">throw new </span><span style="color:#0086b3;">Error</span><span style="color:#323232;">(</span><span style="color:#183691;">'Invalid PKCS8'</span><span style="color:#323232;">);
</span><span style="color:#323232;">  </span><span style="font-weight:bold;color:#a71d5d;">if </span><span style="color:#323232;">(versionType </span><span style="font-weight:bold;color:#a71d5d;">!== </span><span style="color:#183691;">'INTEGER'</span><span style="color:#323232;">) </span><span style="font-weight:bold;color:#a71d5d;">throw new </span><span style="color:#0086b3;">Error</span><span style="color:#323232;">(</span><span style="color:#183691;">'Invalid PKCS8'</span><span style="color:#323232;">);
</span><span style="color:#323232;">  </span><span style="font-weight:bold;color:#a71d5d;">if </span><span style="color:#323232;">(version </span><span style="font-weight:bold;color:#a71d5d;">!== </span><span style="color:#0086b3;">0</span><span style="color:#323232;">) </span><span style="font-weight:bold;color:#a71d5d;">throw new </span><span style="color:#0086b3;">Error</span><span style="color:#323232;">(</span><span style="color:#183691;">'Unsupported PKCS8 Version'</span><span style="color:#323232;">);
</span><span style="color:#323232;">  </span><span style="font-weight:bold;color:#a71d5d;">const </span><span style="color:#323232;">[algorithmIdentifierType, algorithmIdentifierValues] </span><span style="font-weight:bold;color:#a71d5d;">= </span><span style="color:#323232;">algorithmIdentifierTuple;
</span><span style="color:#323232;">  </span><span style="font-weight:bold;color:#a71d5d;">if </span><span style="color:#323232;">(algorithmIdentifierType </span><span style="font-weight:bold;color:#a71d5d;">!== </span><span style="color:#183691;">'SEQUENCE'</span><span style="color:#323232;">) </span><span style="font-weight:bold;color:#a71d5d;">throw new </span><span style="color:#0086b3;">Error</span><span style="color:#323232;">(</span><span style="color:#183691;">'Invalid PKCS8'</span><span style="color:#323232;">);
</span><span style="color:#323232;">  </span><span style="font-weight:bold;color:#a71d5d;">const </span><span style="color:#323232;">[privateKeyType, privateKey] </span><span style="font-weight:bold;color:#a71d5d;">= </span><span style="color:#323232;">privateKeyTuple;
</span><span style="color:#323232;">  </span><span style="font-weight:bold;color:#a71d5d;">if </span><span style="color:#323232;">(privateKeyType </span><span style="font-weight:bold;color:#a71d5d;">!== </span><span style="color:#183691;">'OCTET_STRING'</span><span style="color:#323232;">) </span><span style="font-weight:bold;color:#a71d5d;">throw new </span><span style="color:#0086b3;">Error</span><span style="color:#323232;">(</span><span style="color:#183691;">'Invalid PKCS8'</span><span style="color:#323232;">);
</span><span style="color:#323232;">  </span><span style="font-weight:bold;color:#a71d5d;">if </span><span style="color:#323232;">(checkOID) {
</span><span style="color:#323232;">    </span><span style="font-weight:bold;color:#a71d5d;">for </span><span style="color:#323232;">(</span><span style="font-weight:bold;color:#a71d5d;">const </span><span style="color:#323232;">[type, value] </span><span style="font-weight:bold;color:#a71d5d;">of </span><span style="color:#323232;">algorithmIdentifierValues) {
</span><span style="color:#323232;">      </span><span style="font-weight:bold;color:#a71d5d;">if </span><span style="color:#323232;">(type </span><span style="font-weight:bold;color:#a71d5d;">=== </span><span style="color:#183691;">'OBJECT_IDENTIFIER' </span><span style="font-weight:bold;color:#a71d5d;">&& </span><span style="color:#323232;">value </span><span style="font-weight:bold;color:#a71d5d;">=== </span><span style="color:#323232;">checkOID) {
</span><span style="color:#323232;">        </span><span style="font-weight:bold;color:#a71d5d;">return </span><span style="color:#323232;">privateKey;
</span><span style="color:#323232;">      }
</span><span style="color:#323232;">    }
</span><span style="color:#323232;">    </span><span style="font-weight:bold;color:#a71d5d;">return </span><span style="color:#0086b3;">null</span><span style="color:#323232;">; </span><span style="font-style:italic;color:#969896;">// Not an error, just doesn't match
</span><span style="color:#323232;">  }
</span><span style="color:#323232;">
</span><span style="color:#323232;">  </span><span style="font-weight:bold;color:#a71d5d;">return </span><span style="color:#323232;">privateKey;
</span><span style="color:#323232;">}
</span>

I wrote a “plain English” library in Javascript to demystify all the magic of Let’s Encrypt, ACME, and all those certificates. (Also to spin up my own certs in NodeJS/Chrome).

github.com/…/privateKeyInformation.js#L40

Edit: To be specific, PKCS8 is usually a PKCS1 (RSA) key with some wrapping to identify it (the OID). The integers (BigInts) you pick for RSA would have to line up in some way, but I would think it’s doable. At worst there is maybe a character or two of garbage at the breakpoints for the RSA integers. And if you account for which ones are absent in the public key, then anybody reading it could get a kick out of reading your public certificate.

MehBlah ,

It the length not the content for the most part. Some keys have syntax such as leading or trailing characters.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • lifeLocal
  • goranko
  • All magazines