1

I've read this interesting comment (about the security level, or lack thereof of some website built by a prominent chip manufacturer, an interesting discussion by it's own virtue, but not my question)

Here is the comment (the bold section is my addition)

So I thought I'd test it out a little more. Pretended I'd forgotten my password. Pressed the link and it said 'Password emailed'. Turns out it's not as bad as that! I wasn't emailed my password. I was emailed a link. http://appcenter.html5tools-software.intel.com/csd/ForgotPas... That's fine. So there's this unique token that means only I can reset my password... Except... Let me decode that token... EYl0htUzhivYzcIo+zrIyEFQUE1PQkk= -> t3+(:APPMOBI So does this mean I could reset anyone's password, given their email address? Anyway I went to the page and put a new password in (trying to follow the unstated rules found previously). When I pressed submit, the page darkened and I was told 'Error 500'. Tried again with a new password and was told 'Password must contain one of the following !@#$% special character[s].[sic] Well, I was told it for a second, but the message went away really quickly, so I had to keep submitting the password it didn't like until I'd remembered what the characters it required were. Anyway the password reset link doesn't appear to expire, so if you fancy logging in to Intel AppCenter as me, just reset my password. I can always reset it back if I want to use it.

My question

It might be very naive of me, but how did the OP decode this random string? How did she/he know how it was encoded? Is there a naming convention when someone say they "decoded" something which is implied here? I mean it can be encoded in so many algorithms, how did the OP know which algorithm it was encoded with?

Is there some "first thing you check" when decoding something since it's the most commonly used method?

What algorithm was used to decode it?

1
  • p.s. should this question move to crypto.stackexchange.com? in any case if it can be improved by any way, please leave a comment / edit
    – Eran Medan
    Apr 18, 2013 at 14:00

2 Answers 2

1

deBase64(EYl0htUzhivYzcIo+zrIyEFQUE1PQkk=) basically gives the answer...

HINT: = is on the end of the string (look BASE64 section padding)

doesn't look very random ;-)

3

Base64 encoding encodes arbitrary data into an alphabet of mixed-case alphanumeric and 2 symbols (frequently + and /) with padding of between 0 and 3 = symbols. It's pretty easy to recognize a string that matches these characteristics, especially the = at the end.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .