Got to admit, banning posts about Q legitimacy, while ignoring marriage shill posts...

Is a pretty big tell...

>>23860

So the old known Q passwords still result in the same known trips...

This PW ends in an exclamation point...

Meaning the salt is the same as 2018...

And it site-wide...

A layer of security would allow boards to add their own modifier to the site salt...

>>24026

>>24028

>your saying

>

>that a now known password for one of Q's tripcode circa 2018 is RIGHT NOW resulting in the tripcode from 2018???

Yes.

>>24030

OK that was my first attempt at Tripcode and clearly I don't know shit about how to do that...

>>24034

I'm basing it off this Anon's post, which uses Q's old password.

And hopefully this post does too

>>24043

But it does not...

Meaning that >>23860 knows how to generate passwords that match old trips based on the new hash

>>24047

>>24052

>and salt has been rotated since it died

test with old Q PW appear to confirm that it has...

>>24052

> hard-coded bypass

at least 50% likely this...

So who is >>23860 ?

Surely that PHP is not accessible at the BO level....

>>24061

>It's my post that got tagged, too.

>>23860 posted 2 minutes after you referenced "HARDCODED FUCKERY"...

Seems unlikely that site mgmt would hard-code an old Q trip from 2018 that shouldn't even be achievable based on 2019 salt rotation...

>>24066

>this post seems to confirm there is absolute hardcoded fuckery going on

This...

>but "who" holds the code to be able to make that post???

This...

>because it doesnt looks like Jim LARPing for keks to me

And this...

>>24070

>This is called a collision. It's not impossible, just incredibly rare. Cryptographers know this.

kek what

>>24069

>in drop Q823 Q does tell CM to "Check code line 1183"

>>24076

Kek. OK brah...

I'm surprised you think this will fly....

But I'll just pay attention and learn...

>>24079

>>>23860

>Has tripcode: !UW.yye1fxo

>Used from: 2017-12-15 06:04:06Z to 2018-03-24 13:09:02Z

So there are 2 options.

1) new password + new salt = old Q Trip

This can be achieved by brute force, quite easily if you have the physical server in your possession. Doing it remotely would be very resource intensive and would most likely get you noticed by site admin. Obviously, this "collision attack" can only be brute force and not chance.

Why would anyone brute force an old Q Trip?

2) hard coded.

>>23860 was in response to a post about "hardcoded fuckery"

>>24047 illustrates some example code

>>24084

> the person who posted had the password Q used

Nope. I tested that. The salt was rotated in 2019. Old Q passwords do not result in old Q trips.

1) New password + new salt = old trip.

Or,

2) hard coded

Those are the options

>>24088

Yeah I think that's what the evidence suggests...

But then for the grand prize....

Why would site admin hard-code an old Q trip that shouldn't even be possible since the salt rotation of 2019....

>>24089

That's not what he's saying...

He's saying any password can be hard coded to any trip...

>>24096

>So are you saying someone did a hardcode for the Q post in here that has the old trip code?

That's the difficult question...

My take is -->>24090

>Yeah I think that's what the evidence suggests...

>But then for the grand prize....

>Why would site admin hard-code an old Q trip that shouldn't even be possible since the salt rotation of 2019....

>>24104

>Who ever it is

kek one anon suggested it was Q

>>23860

timestamp, ID, and post number all add up to 19....

For what it's worth...

Grassley said corn was 17 grew by 19 to be 36... kek....

>>24114

>Grassley said corn was 17 grew by 19 to be 36... kek....

Just for the keks...

>>24112

>why would they expose their ability to bypass trip authentication?

Exactly. It would be like Bidan saying he has "the_most_extensive_VOTER_FRAUD_organization_in_history" - that would never happen....

What's the alternative?

>>24120

>if that anon is still here

Anyone could get it...

An MSM blog place published them after they were hacked...

I guess since the salt has changed, it means nothing to share them now....

But I still feel like anons should go find them online rather than just post them cleartext here....

But yeah Matlock is a famous one.... My understanding is the M is supposed to be capitalized...

Supposed to yield a trip beginning ITPb....

Trying it now...

>>24121

>!UW.yye1fxo is one that had a leaked password? Is that matlock

That one is supposed to have been a slight variation of matlock...

>>24127

kek a 1 hour ban.... that's not too bad....

>>24131

>At this point you all are just explaining to J-Crew where they fucked up,

Why does this all seem so familiar

>>24137

Yeah.

There were no more known hacks of the Trip after ##1835.....

8/10/18...

Palindome....

Skyking day...

>>24144

Dude. You did it. That's Q's Old trip

>>24144

Proof of concept.... Apparently salt has not in fact changed since 8chan days????

WTF????

Unless all Q trips are hard coded????

test 1

>>24151

Yeah that's the trick. One hash. They are the old kind of trip with low security

OK going for Q's last trip before 8/10/18

>>24162

>OK going for Q's last trip before 8/10/18

OK either salt hasn't changed in a LOOOONG time, or all Q trips are hardcoded

>>24162

OK now trying this one

This bread is archived btw...

https://archive.ph/kPZPm

>>24174

>stopping us from getting !UW.yye1fxo?

nothing. I was using 2 hashes. Now I'm using 1.!

>>24181

>Salt rotation only affects secure trips, not insecure trips.

Ahh. TYVM

>>24186

>shits fucky guys

Nah we have to rethink the whole thing.

>>24181 realized that these are insecure trips that don't require salt

>>24190

--->>24191

>Nah we have to rethink the whole thing.

>>24188

>I dont know i see salts being used here

Yeah that's just for double-hash "secure" trips

>>24200

>when was Q's first !! tripcode?

##1836

8/10/18

skyking day

https://qagg.news/?q=%23%231836

>>24202

>>when was Q's first !! tripcode?

>##1836

>8/10/18

>skyking day

>>24224

>So the >>23860 is meaningless in regards to salt at this point. Someone likely just fucking with us.

this is the way

>>24231

>Well, shit, there went my Q-You.

>>24280

>theonlyway to generate this!!Hs1Jq13jV6tripcode after the salt had been rotated is with custom_tripcode

So who rotated the salt 3 hours prior to ##4954?

Because doesn't that give the game away?

4 post identifies 84-year cycle

1770s

civil war

ww2

now

"uranus into gemini"

https://boards.4chan.org/pol/thread/384967295

Anon said sometimes it's like they're just screwing with us

4 comes up with good stuff

How long would it take to brute force the low security single-hash version of a trip?

I tried overnight...

e.g.

Level 3 of Area S-4 contained the residential living quarters for members of Majestic 12. Dan and I are only willing to say the following, and only that information may be represented as coming from us: “The former Leader of the Consistory of the Majestic was accurately identified by Dr. Dan in an affidavit sworn under

penalty of perjury. That former leader was a high ranking official in:

a) The United States Navy

b) The National Security Agency (NSA)

c) The director of National Intelligence’s Office

PROJECT_AQUARIUS_DOCUMENT.pdf

https://drive.google.com/file/d/1TbjfpzGQNjy46m6dW9N1fR64JPEUNcn3/view

>>24483

It's been established that Q's trip is hard coded into the system, not dependent on the salt.

It's troubling why they would fumble like that and make it so apparent to everyone.

What about the "whitelist" system? Is that just another name for the hard-coding function "custom_tripcode" (or similar - I believe that function was just an example of what was "possible" that freddy produced)

I have seen nothing that really sheds light on what Jim means by "whitelisting" Q's trip

>>24485

>poster (that never IP hops) get a DIFFERENT UID

I think the UID is cookie dependent, not just IP. Maybe not dependent on IP at all?

The admins have access to the IP hashes, which are different to the UIDs

F A Q

F-117