Royce Williams

https://infosec.exchange/@tychotithonus

Just doing my undue diligence.

ISP vet, password cracker (Team Hashcat), security demi-boffin, YubiKey stan, public-interest technologist, AK license plate geek. Husband to a philosopher, father to a llama fanatic. Views his.

Day job: Ent Sec Arch for a quad-play Alaskan ISP.

Obsessed with security keys: techsolvency.com/mfa/security-keys

My 2017 #BSidesLV talk "Password Cracking 201: Beyond the Basics":
youtube.com/watch?v=-uiMQGICeQY&t=20260s

Profile photo: White 50-ish man with big forehead, short beard, and glasses, looking pleased in front of a display of Alaskan license plates.

Banner photo: 5 rows of security keys in a wall case.

Blocked inadvertently? Ask!

Am I following a dirtbag? Tell me!

Followed you out of the blue = probably stole you from follows of someone I respect.

#NonAIContent

#hashcat #Alaska #YubiKey #YubiKeys #WebAuthn #FIDO #LicensePlates

P.S. I hate lottery / advance-fee scammers with the heat of 400B suns.

❤️:⚛👨‍👩‍👧🛡🙊🌻🗽💻✏🎥🍦🌶🍫

Stuff: https://www.techsolvency.com/roycewilliams/mastodon
Keybase: https://keybase.io/royce
GitHub: https://github.com/roycewilliams
LinkedIn: https://www.linkedin.com/in/roycewilliams
Gravatar: https://gravatar.com/tychotithonus
Not "dehashed": https://www.techsolvency.com/passwords/dehashing-reversing-decrypting/

Public Key

npub1d9j86kugzarj4skw6juglk2de6mful9svqu8yac6vum5wz5xtcwsyv7m3z

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsxjeratwypw3e2ct8dfwy0m9xuad570jcxqwrjwudxwd68p2r9u8gpzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhgwqwhse

Publishing to

relay.primal.net

Author Public Key

npub1d9j86kugzarj4skw6juglk2de6mful9svqu8yac6vum5wz5xtcwsyv7m3z

Show more details

Published at

2024-09-14T02:15:46+02:00

Kind type

0 Metadata

Event JSON

{ "id": "4f6378c1517454830ceb49307b5db121891b52c9821c5ad5bcd454cb6703b81c", "pubkey": "69647d5b8817472ac2ced4b88fd94dceb69e7cb0603872771a6737470a865e1d", "created_at": 1726272946, "kind": 0, "tags": [ [ "t", "yubikey" ], [ "t", "alaska" ], [ "t", "webauthn" ], [ "t", "fido" ], [ "t", "hashcat" ], [ "t", "bsideslv" ], [ "t", "yubikeys" ], [ "t", "licenseplates" ], [ "t", "nonaicontent" ], [ "proxy", "https://infosec.exchange/users/tychotithonus", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://infosec.exchange/users/tychotithonus", "pink.momostr" ], [ "-" ] ], "content": "{\"name\":\"Royce Williams\",\"about\":\"Just doing my undue diligence.\\n\\nISP vet, password cracker (Team Hashcat), security demi-boffin, YubiKey stan, public-interest technologist, AK license plate geek. Husband to a philosopher, father to a llama fanatic. Views his.\\n\\nDay job: Ent Sec Arch for a quad-play Alaskan ISP.\\n\\nObsessed with security keys: techsolvency.com/mfa/security-keys\\n\\nMy 2017 #BSidesLV talk \\\"Password Cracking 201: Beyond the Basics\\\":\\nyoutube.com/watch?v=-uiMQGICeQY\u0026t=20260s\\n\\nProfile photo: White 50-ish man with big forehead, short beard, and glasses, looking pleased in front of a display of Alaskan license plates.\\n\\nBanner photo: 5 rows of security keys in a wall case.\\n\\nBlocked inadvertently? Ask!\\n\\nAm I following a dirtbag? Tell me!\\n\\nFollowed you out of the blue = probably stole you from follows of someone I respect.\\n\\n#NonAIContent\\n\\n#hashcat #Alaska #YubiKey #YubiKeys #WebAuthn #FIDO #LicensePlates\\n\\nP.S. I hate lottery / advance-fee scammers with the heat of 400B suns.\\n\\n❤️:⚛👨‍👩‍👧🛡🙊🌻🗽💻✏🎥🍦🌶🍫\\n\\nStuff: https://www.techsolvency.com/roycewilliams/mastodon\\nKeybase: https://keybase.io/royce\\nGitHub: https://github.com/roycewilliams\\nLinkedIn: https://www.linkedin.com/in/roycewilliams\\nGravatar: https://gravatar.com/tychotithonus\\nNot \\\"dehashed\\\": https://www.techsolvency.com/passwords/dehashing-reversing-decrypting/\\n\",\"website\":\"https://infosec.exchange/@tychotithonus\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/108/195/621/247/550/549/original/d96204cc09c9dbfe.jpg\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/108/195/621/247/550/549/original/b3a795ba13420388.jpeg\",\"nip05\":\"[email protected]\"}", "sig": "7f1645a177edaa165691d6e0e4b9dcfe1a5971220ab127df8c305dbe050ff35cd77b6d9be66efa3e82012c274ca0afebb16d46dcdc99e8bc347be17792634f7b" }

Last Notes

2024-06-12 00:31:16

- reply

And the original authors of login.defs, PAM, etc did sooo much damage by choosing to name many of the earlier hash selections using their primitives. 😢

2024-06-12 00:31:16

- reply

And the original authors of login.defs, PAM, etc did sooo much damage by choosing to name many of the earlier hash selections using their primitives. 😢

2024-05-14 22:04:45

- reply

Heh, yeah. I mean, I kinda ... enjoyed it? 😅 It's true in spirit to his text-purist approach, which comes from a very Long-Now-ish / lowest common denominator perspective. But some whitespace between slides would be good.😁

2024-05-14 03:08:54

So [@solardiz](https://bird.makeup/users/solardiz ) presented a talk on "Password cracking: past, present, future" at OffensiveCon last week. Definitely worth a read - bringing his usual disciplined thinking to a topic he knows very well.
He includes both historical and taxonomical perspectives, both of which I appreciate. Apparently, one of the first password-cracking contests was in 1982? (This was a password *cracker* contest - seeking the best *cracking software*!)
https://www.openwall.com/presentations/OffensiveCon2024-Password-Cracking/
[Will update post if video of the talk itself appears.]
#passwords #hashing
#PasswordCracking

2024-04-15 19:07:36

- reply

Huh - TIL!

2024-04-01 16:54:10

- reply

Ooh, exactly!
https://infosec.exchange/@tychotithonus/112192099235146057
[@nerdpr0f](https://infosec.exchange/@nerdpr0f)

2024-03-29 21:51:16

Reflecting on how the xz backdoor was uncovered because ssh was slow ...
How long would it have taken the ecosystem to notice an *aggregate* slowdown in SSH on eligible systems?
How do/can distros manage *end-to-end* testing - to compare performance/behavior to a baseline?
How can we automate additional anomaly detection (commits that contain obfuscation, graph of expected and unexpected component/package interaction, etc.)?
#xz #cve20243094