Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've read this interesting comment (about the security level, or lack thereof of some website built by a prominent chip manufacturer, an interesting discussion by it's own virtue, but not my question)

Here is the comment (the bold section is my addition)

So I thought I'd test it out a little more. Pretended I'd forgotten my password. Pressed the link and it said 'Password emailed'. Turns out it's not as bad as that! I wasn't emailed my password. I was emailed a link. http://appcenter.html5tools-software.intel.com/csd/ForgotPas... That's fine. So there's this unique token that means only I can reset my password... Except... Let me decode that token... EYl0htUzhivYzcIo+zrIyEFQUE1PQkk= -> t3+(:APPMOBI So does this mean I could reset anyone's password, given their email address? Anyway I went to the page and put a new password in (trying to follow the unstated rules found previously). When I pressed submit, the page darkened and I was told 'Error 500'. Tried again with a new password and was told 'Password must contain one of the following !@#$% special character[s].[sic] Well, I was told it for a second, but the message went away really quickly, so I had to keep submitting the password it didn't like until I'd remembered what the characters it required were. Anyway the password reset link doesn't appear to expire, so if you fancy logging in to Intel AppCenter as me, just reset my password. I can always reset it back if I want to use it.

My question

It might be very naive of me, but how did the OP decode this random string? How did she/he know how it was encoded? Is there a naming convention when someone say they "decoded" something which is implied here? I mean it can be encoded in so many algorithms, how did the OP know which algorithm it was encoded with?

Is there some "first thing you check" when decoding something since it's the most commonly used method?

What algorithm was used to decode it?

share|improve this question
    
p.s. should this question move to crypto.stackexchange.com? in any case if it can be improved by any way, please leave a comment / edit –  Eran Medan Apr 18 '13 at 14:00
add comment

2 Answers

up vote 1 down vote accepted

deBase64(EYl0htUzhivYzcIo+zrIyEFQUE1PQkk=) basically gives the answer...

HINT: = is on the end of the string (look BASE64 section padding)

doesn't look very random ;-)

share|improve this answer
add comment

Base64 encoding encodes arbitrary data into an alphabet of mixed-case alphanumeric and 2 symbols (frequently + and /) with padding of between 0 and 3 = symbols. It's pretty easy to recognize a string that matches these characteristics, especially the = at the end.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.