Nearly got scammed on here!!

[tauzero]

31 minutes ago, jrixn1 said:

 

I agree.  I thought people were talking about recovering passwords from data i.e. when the hashed password file has been leaked.
If you don't have that file, then like you say, you can't brute force directly on the live site as it would take billions of years - and the site locks you out after three attempts anyway.
Perhaps a less worse method would be the other way round: pick a common password and then try it in combination with known usernames.
 

 

I had a bit of a dig around. Brute force attacks will depend on the method used to hash the password entries - https://en.wikipedia.org/wiki/Crypt_(C) has some information on that. Apparently bcrypt is better than SHA-based hashes as it takes longer to work out the hash.

 

This is worth looking at too: https://www.komando.com/security-privacy/check-your-password-strength/783192/

 

It has a chart of how long a brute force attack would take on a password. When Chrome generates a password for you, it's 15 characters, mixed numbers, upper-case, lower-case, and special characters, which according to that chart would take 15bn years to crack. If I'm making up my own password that I can leave myself clues to (rather than writing it down in plain text), it will be 9 or more characters from that same set, so would take three weeks or five years to crack.

[tauzero]

Ah, @MartinB has already put the chart up on the previous page.

[BillyBass]

3 hours ago, cheddatom said:

When I was a kid we got a hash of the school's network admin password and cracked it in just over 3 days with a computer running constantly at home. That would have been 1999 ish

So, let us know what mischief you got up to.  Photoshopping the headmaster's face onto a pornstar at work and emailing to around?

Edited June 7, 2023 by BillyBass

[RikiB]

2 hours ago, lidl e said:

What was the scammer "selling"?

 

Anything good?

He was selling 

Fender Roadworn Jazz bass for £450

the add said it didn’t suit the gigs he was having or something.

Arkham DI for £275 I think

Mesa Boogie Subway 800+ £300

Line 6 HX stomp £200 (although was listed as Helix Stomp 😂)

 

All looked genuine and from a Basschat user.

 

 

[Kev]

2 minutes ago, RikiB said:

He was selling 

Fender Roadworn Jazz bass for £450

the add said it didn’t suit the gigs he was having or something.

Arkham DI for £275 I think

Mesa Boogie Subway 800+ £300

Line 6 HX stomp £200 (although was listed as Helix Stomp 😂)

 

All looked genuine and from a Basschat user.

 

 

To be honest the only one that stands out as being TOO cheap is the Mesa, mainly because I don't know anything about the Arkham and I swore I had a similar Jazz that didn't go for a huge amount more.  I think they would have scammed many more if he'd have gone the FB route instead, that's assuming they haven't...

[Woodinblack]

26 minutes ago, RikiB said:

He was selling 

Fender Roadworn Jazz bass for £450

the add said it didn’t suit the gigs he was having or something.

Arkham DI for £275 I think

Mesa Boogie Subway 800+ £300

Line 6 HX stomp £200 (although was listed as Helix Stomp 😂)

 

All looked genuine and from a Basschat user.

 

They looked from a basschat user, but the prices didn't look very genuine!

[fretmeister]

4 hours ago, Reggaebass said:

I use facial recognition where possible and quicker than long passwords 

 

Unfortunately facial recognition hacking is already here.

 

https://www.technologyreview.com/2020/08/05/1006008/ai-face-recognition-hack-misidentifies-person/

 

https://www.wired.com/story/windows-hello-facial-recognition-bypass/

 

https://www.bbvaopenmind.com/en/technology/innovation/how-to-hack-a-face-from-facial-recognition-to-facial-recreation/

 

A friend of mine is a Professor of Computer Science at a well known UK university and he researches this stuff.

The main problem with any biometrics is that once it is hacked it is hacked forever. You cannot change your face, your eyes, your fingerprints, your DNA etc etc.

 

Two Factor systems are far more secure than any single factor system. Use 2FA for every place that offers it, and seriously think about not using anything that doesn't.

 

 

[paul_c2]

You mean I need to change my password from "password" to something else????

[Marky L]

8 minutes ago, paul_c2 said:

You mean I need to change my password from "password" to something else????

 

I don't think you should tell people what you are changing it to.. 😉

[Reggaebass]

33 minutes ago, fretmeister said:

Unfortunately facial recognition hacking is already here

Looks like they got to do quite a bit of work to get it, and I’m guessing it can’t be done remotely, but I get what you’re saying 👍, I do use 2FA or 3 where facial isn’t available 

[Woodinblack]

42 minutes ago, fretmeister said:

The main problem with any biometrics is that once it is hacked it is hacked forever. You cannot change your face, your eyes, your fingerprints, your DNA etc etc.

 

Indeed you can't but you can change how you scan those things, or what element of those bits you use.

[chaypup]

2 hours ago, RikiB said:

He was selling 

Fender Roadworn Jazz bass for £450

the add said it didn’t suit the gigs he was having or something.

Arkham DI for £275 I think

Mesa Boogie Subway 800+ £300

Line 6 HX stomp £200 (although was listed as Helix Stomp 😂)

 

All looked genuine and from a Basschat user.

 

 

I've never heard of Arkham and I've never owned a Fender! I'm going to have to wait ages to sell my Stomp now though 😭 😉

[binky_bass]

Any chance this is our friend Mick Mason?

[Tokalo]

7 hours ago, cheddatom said:

When I was a kid we got a hash of the school's network admin password and cracked it in just over 3 days with a computer running constantly at home. That would have been 1999 ish

Ah, the good old days when you got a proper education at school!

 

(I'm only jealous - I left school the year they brought the first BBC PCs into a classroom).

[TimR]

My friend's daughter can unlock her mum's phone via facial recognition. 

[Skinnyman]

Do quantum computers, when they become mainstream, make things a little easier or more challenging for the hacker, I wonder?

[Beedster]

2 hours ago, binky_bass said:

Any chance this is our friend Mick Mason?

My first thought on reading this thread 😆

[Woodinblack]

3 hours ago, binky_bass said:

Any chance this is our friend Mick Mason?

 

I would say vanishingly little chance, unless he isn't a native english speaker.

[Downunderwonder]

13 hours ago, asingardenof said:

Assuming 56 alphabetic characters (all upper and lowercase letters), 10 numeric, and let's say 30 special as you suggest, that's 96 possible options per character entry. Assuming 10 characters, that gives us 96P10 or 4.093x10^19 possible combinations. Attempting them @ 1s would take something in the region of 12.8 trillion years. I'm guessing that computers might be able to do it slightly faster than this though...

 

13 hours ago, jrixn1 said:

https://en.wikipedia.org/wiki/Password_cracking
"the number of possible passwords per second which can be checked can be in the billions or trillions per second"
 

Taking both of you at face value we get down to 12.8 ÷ some round number less than 10 = some round number of years and change.

 

So when computers get some hundreds of times faster again we will be down to days, hours...or we could be there already if the Wiki is out of date by eighteen months.

[TimR]

The hacking isn't done by some character in his bedroom. It's done by organisations with server farms, and whole call centres full of staff dedicated to making scam calls and setting up fake Facebook profiles and pages. 

 

It's not one man with one computer trying one password after the other to see which one it is.

[tegs07]

14 minutes ago, TimR said:

The hacking isn't done by some character in his bedroom. It's done by organisations with server farms, and whole call centres full of staff dedicated to making scam calls and setting up fake Facebook profiles and pages. 

 

It's not one man with one computer trying one password after the other to see which one it is.

There are plenty of one man band ‘script kiddies’ out there making a PITA of themselves with the low hanging fruit.

[nekomatic]

Sorry to hear that anyone has lost money and thanks for all the good advice. 
 

Not directly related to this scam but worth mentioning while security is on people’s minds, check that your phone doesn’t show the contents of incoming messages on the lock screen. There were reports in the news of a spate of thefts where people had phones and bank cards stolen from their locker while they were at the gym, then their bank accounts were cleaned out. The way this worked was the thief got the bank account details from the card and used them to set up the app for that bank on their own phone, which the bank verified by sending a code in a text message which the thief could see arriving on the locked phone. On iPhone you want to set Settings>Notifications>Show Previews to ‘When Unlocked, not ‘Always’. 

[tegs07]

5 minutes ago, nekomatic said:

Sorry to hear that anyone has lost money and thanks for all the good advice. 
 

Not directly related to this scam but worth mentioning while security is on people’s minds, check that your phone doesn’t show the contents of incoming messages on the lock screen. There were reports in the news of a spate of thefts where people had phones and bank cards stolen from their locker while they were at the gym, then their bank accounts were cleaned out. The way this worked was the thief got the bank account details from the card and used them to set up the app for that bank on their own phone, which the bank verified by sending a code in a text message which the thief could see arriving on the locked phone. On iPhone you want to set Settings>Notifications>Show Previews to ‘When Unlocked, not ‘Always’. 

Personally I would never leave my phone in a locker at the gym. At the very least make sure that your phone is SIM locked.

[cheddatom]

19 hours ago, BillyBass said:

So, let us know what mischief you got up to.  Photoshopping the headmaster's face onto a pornstar at work and emailing to around?

We just played Quake at lunchtime. So rebellious!

[jimmyb625]

20 hours ago, paul_c2 said:

You mean I need to change my password from "password" to something else????

Password1