explain xkcd - User contributions [en]

1377: Fish

2014-06-04T09:12:57Z

108.162.219.29: /* Explanation */ fmt, link

{{comic
| number = 1377
| date = June 4, 2014
| title = Fish
| image = fish.png
| titletext = [Astronomer peers into telescope] [Jaws theme begins playing]
}}

==Explanation==
The {{w|Fermi Paradox}} is the contradiction that arises between the high likelihood of {{w|extraterrestial life}} and the fact that no evidence for it has thus been found.

[[Cueball]] and [[Megan]] are having a conversation regarding this, when Megan suggests that perhaps our search for extraterrestrial life is like looking at a patch of ocean floor looking for a fish. The diver knows that there must be a fish somewhere, but is unable to actually find it. She then goes on to ask why the fish would be hidden - i.e. camouflaged, and what it means about the remaining fish. The suggestion is that the fish would be hidden to avoid being eaten by predators, and perhaps the reason no extraterrestrial life is sending any sign of existence back is that they would be destroyed soon after they revealed their location.

The final panels take the metaphor further, suggesting that there is literally a planet sized shark swimming through space eating planets, and since we are panning away from earth and out to the Shark it is obviously heading our way... And it turns out that Earth is the next fish!

This explains the title text that has the theme from the movie ''{{w|Jaws (film)|Jaws}}'' playing while astronomers look into their telescopes. This may also be a reference to the film ''{{w|Alien (film)|Alien}}'', which was pitched with the three word proposal "''Jaws'' in Space."

==Transcript==
{{incomplete transcript}}

[Cueball and Megan are walking down a hill]

Cueball: The Fermi paradox keeps getting worse. If planets are common, where '''is''' everybody?

Megan: Imagine you're a SCUBA diver looking at the ocean floor. You know there's a fish there, but you can't see it. Why?

Cueball: Maybe the fish looks like sand.

Megan: Yeah...

[Zoom out to the Earth from space]

Megan: ...and what would that tell you about the ecosystem?

[Pan to a shark swimming through space towards Earth]

{{comic discussion}}

593: Voynich Manuscript

2014-05-31T22:28:42Z

108.162.219.29: /* Explanation */ clarified use of "your"

{{comic
| number = 593
| date = June 5, 2009
| title = Voynich Manuscript
| image = voynich_manuscript.png
| titletext = Wait, is that the ORIGINAL voynich manuscript? Where did you GET that? Wanna try playing a round of Druids and Dicotyledons?
}}

==Explanation==
The {{w|Voynich manuscript}} is a very detailed book written in an unknown script, describing plants and recipes, most of which lack a real-world analogue. Over the past few decades, linguists and cryptographers have unsuccessfully attempted to decode the book.

{{w|Tabletop role-playing game|Tabletop role-playing games}} (such as {{w|Dungeons and Dragons}}) are fantasy games with extremely detailed descriptions of fantastical worlds.

After being shown the manuscript for the first time by [[Megan]], [[Cueball]] argues that it should be obvious that it's just an ancient role-playing-game rulebook, since the human tendency to invent fantastical worlds must have also existed in the past.

After concluding this, a shocked Cueball then asks in the title text how Megan got her hands on the original manuscript (which is in the Yale University's ''{{w|Beinecke Rare Book and Manuscript Library}}''). Megan unexpectedly suggests the prosaic activity of playing {{w|Druid|Druids}} and {{w|Dicotyledon|Dicotyledons}}, assuming such a game could be defined by the manuscript.

Note that the use of the pronoun "your" in the last frame is anachronistic, as in early modern English it was used as a plural pronoun, or as a singular pronoun only to a superior; the proper pronoun would be "thy": "Thy Druid doth lose two points."

Note also that it's ''{{w|glossolalia}}'' not ''glossolatia'' at the third panel.

==Transcript==
:[Weird root vegetables surround a strange script.]

:[Megan holding up book.]
:Megan: This is the Voynich manuscript—a book, allegedly 500 years old, written in an unrecognized script. It's some kind of visual encyclopedia of imaginary plants and undeciphered "recipes".

:[Cueball opens the book.]
:Megan: It could be a hoax, a lost language, a cipher, an alien text, glossolatia—no one knows.
:Cueball: No one? But it's obvious.

:Megan: ...Obvious? Linguists and cryptographers have been stumped for decades.
:Cueball: They forget. Human nature doesn't change.

:Cueball: Just imagine someone found a book from our time, full of lists, illustrations, tables, and long, dry descriptions of nonexistent worlds written in an invented language. What have they found?
:Megan: ...Dear Lord. It ''is'' obvious.

:500 Years Earlier:
:[Three people are standing around pawns and a die. One is holding a sheet of paper, another is holding a book, the third is holding a scythe.]
:Person #1: Forsooth! I concoct an elixir of courage.
:Person #2: Nae! The source booke sayeth that requires some wolfsbane!
:Person #3: Your druid doth lose two points.

{{comic discussion}}
[[Category:Comics featuring Cueball]]
[[Category:Comics featuring Megan]]

435: Purity

2014-05-25T14:51:22Z

108.162.219.29: who's/whose typo corrected

{{comic
| number = 435
| date = June 11, 2008
| title = Purity
| image = purity.png
| titletext = On the other hand, physicists like to say physics is to math as sex is to masturbation.
}}

==Explanation==
{{w|Mathematics}} is the abstract study of topics encompassing quantity, structure, space, change, and others. {{w|Physics}} is a natural science that involves the study of matter and its motion through space and time, along with related concepts such as energy and force. They do this using mathematics. {{w|Chemistry}} is the science of matter, especially its chemical reactions, but also its composition, structure and properties. That is, they study a subset of physics, using a subset of physics. Biology is the subset of chemistry that is concerned with the study of life and living organisms, including their structure, function, growth, origin, evolution, distribution, and taxonomy. {{w|Psychology}} is the study of mental functions and behaviors, why living things do what they do individually, which makes it a subset of Biology. {{w|Sociology}} is the study of society, or, the study of groups of people and their interactions, which sounds an awful lot like taking the skills of Psychology and applying them.

Taking this logic to the extreme, one can say that a field is 'more pure', and thus matters more, than the fields derived from it. This is a topic often used in jokes between scientists of various fields as to who is more important. The physicist, of which everyone else's work is based upon, feels that he is at the top... but is ultimately upstaged by the mathematician, whose field is so pure that ultimately everything else could be seen as derived from it. After all, physics could not exist without math, thus ultimately everything can be expressed as a mathematical equation. Thus, the mathematician snobbishly says that she didn't even see any of the other fields standing so far over to the left on the graph.

The title text points out math is all just in your head, only for your own pleasure. Physics involves interactions with other objects. This leads to a comparison between sex (physics) and masturbation (mathematics), implying that physics is the real joy in the world.

==Transcript==
:Fields arranged by purity
:[An arrow is shown pointing right with the text 'more pure'. Six people are shown representing six scientific fields. They stand on a scale of purity with the left end representing less purity and the right representing more purity. They appear in this order, from left to right: Sociology, Psychology, Biology, Chemistry, Physics, Mathematics. The mathematician stands much further to the right than any other field.]
:Psychologist: Sociology is just applied Psychology.
:Biologist: Psychology is just applied Biology.
:Chemist: Biology is just applied Chemistry
:Physicist: Which is just applied Physics. It's nice to be on top.
:Mathematician: Oh, hey, I didn't see you guys all the way over there.

{{comic discussion}}
[[Category:Charts]]
[[Category:Comics featuring Cueball]]
[[Category:Comics featuring Megan]]
[[Category:Comics featuring Ponytail]]
[[Category:Psychology]]
[[Category:Biology]]
[[Category:Chemistry]]
[[Category:Physics]]
[[Category:Math]]
[[Category:Sex]]

624: Branding

2014-05-11T13:07:00Z

108.162.219.29: /* Explanation */

{{comic
| number = 624
| date = August 17, 2009
| title = Branding
| image = branding.png
| titletext = Actually, 'RSS&M' is kinda catchy.
}}

==Explanation==
This strip shows four advertisements that appear to [[Cueball]] as he browses the internet without Adblock. ({{w|Adblock Plus|Adblock}} is a browser extension for Firefox/Chrome which prevents advertisements from being displayed). All four ads are for adult-themed websites.

The first advertises a website that brands itself as the "{{w|Facebook}} of sex". Because Facebook is ubiquitous, this is probably a good branding idea. Facebook is known to most users and connotes an easy-to-use platform where it's very easy to find people, chat with them, share pictures, etc. For someone looking for sex, this would probably seem like a good site to use. There are, in fact, sites that use this branding in their advertisements and/or their user interface which is likely what inspired [[Randall]] to write this comic. Cueball sighs and moves on, probably having seen this kind of ad many times already.

The second brands itself as "Twitter for 18+ singles!". It is a similar but (seemingly) invented ad which again plays on the ubiquity and popularity of {{w|Twitter}}. Twitter being a (generally) public chat forum which limits posts to 140 characters is still popular enough to get some attention and make someone think about going to the site, although sending messages to the world in 140 characters or less might be somewhat less of a versatile platform than Facebook for chatting with other singles, but still perhaps viable. Cueball notes that it is becoming more and more popular to brand adult sites by comparing them to popular non-adult sites.

This third takes a turn for the unusual, branding itself as "We're like Google Reader for S&M!". {{w|Google Reader}} is a now-defunct platform that allows users to aggregate web feeds such as RSS feeds into one place for convenience. The service is notably less well-known and popular than Facebook or Twitter, and given that it doesn't directly link you with other people, doesn't have the same connotation of allowing you to connect with others. Perhaps it would be a site that allowed you to aggregate various fan fictions or other written works (Fifty Shades of Grey?) relating to S&M. However, Cueball is still surprised such a site would exist.

The final ad brands itself as "the new GitHub for lesbians!". {{w|GitHub}} is a website that allows developers to collaborate on software projects using the {{w|Git (software)|Git}} revision control system. The concept is absurd — GitHub has a specialized audience and it's barely a social network at all; the usefulness or appeal of such a system to lesbians is not apparent. Cueball is surprised and possibly even intrigued by this last ad.

RSS is a technology involved in Google Reader. RSS&M is a portmanteau of RSS and S&M.

==Transcript==
:Browsing without adblock
:[Cueball is sitting at a computer.]
:[Pop-up window with red background.]
:The Facebook of SEX! Click now!
:Cueball: Sigh.
:<nowiki>*Close*</nowiki>

:[Pop-up window with green background.]
:Twitter for 18+ singles! Join today!
:Cueball: Does every porn site have to brand itself like this?
:<nowiki>*Close*</nowiki>

:[Pop-up window with blue background.]
:We're like Google Reader for S&M!
:Cueball: ''Really?''
:<nowiki>*Close*</nowiki>

:[Pop-up window with orange background.]
:Try the new GitHub for lesbians!
:Cueball: Ok, wait, what?

{{comic discussion}}
[[Category:Comics featuring Cueball]]
[[Category:Comics with color]]
[[Category:Internet]]
[[Category:Portmanteau]]
[[Category:Sex]]
[[Category:Social networking]]

624: Branding

2014-05-11T13:05:37Z

108.162.219.29: /* Explanation */

{{comic
| number = 624
| date = August 17, 2009
| title = Branding
| image = branding.png
| titletext = Actually, 'RSS&M' is kinda catchy.
}}

==Explanation==
This strip shows four advertisements that appear to [[Cueball]] as he browses the internet. All four ads are for adult-themed websites.

The first advertises a website that brands itself as the "{{w|Facebook}} of sex". Because Facebook is ubiquitous, this is probably a good branding idea. Facebook is known to most users and connotes an easy-to-use platform where it's very easy to find people, chat with them, share pictures, etc. For someone looking for sex, this would probably seem like a good site to use. There are, in fact, sites that use this branding in their advertisements and/or their user interface which is likely what inspired [[Randall]] to write this comic. Cueball sighs and moves on, probably having seen this kind of ad many times already.

The second brands itself as "Twitter for 18+ singles!". It is a similar but (seemingly) invented ad which again plays on the ubiquity and popularity of {{w|Twitter}}. Twitter being a (generally) public chat forum which limits posts to 140 characters is still popular enough to get some attention and make someone think about going to the site, although sending messages to the world in 140 characters or less might be somewhat less of a versatile platform than Facebook for chatting with other singles, but still perhaps viable. Cueball notes that it is becoming more and more popular to brand adult sites by comparing them to popular non-adult sites.

This third takes a turn for the unusual, branding itself as "We're like Google Reader for S&M!". {{w|Google Reader}} is a now-defunct platform that allows users to aggregate web feeds such as RSS feeds into one place for convenience. The service is notably less well-known and popular than Facebook or Twitter, and given that it doesn't directly link you with other people, doesn't have the same connotation of allowing you to connect with others. Perhaps it would be a site that allowed you to aggregate various fan fictions or other written works (Fifty Shades of Grey?) relating to S&M. However, Cueball is still surprised such a site would exist.

The final ad brands itself as "the new GitHub for lesbians!". {{w|GitHub}} is a website that allows developers to collaborate on software projects using the {{w|Git (software)|Git}} revision control system. The concept is absurd — GitHub has a specialized audience and it's barely a social network at all; the usefulness or appeal of such a system to lesbians is not apparent. Cueball is surprised and possibly even intrigued by this last ad.

RSS is a technology involved in Google Reader. RSS&M is a portmanteau of RSS and S&M.

==Transcript==
:Browsing without adblock
:[Cueball is sitting at a computer.]
:[Pop-up window with red background.]
:The Facebook of SEX! Click now!
:Cueball: Sigh.
:<nowiki>*Close*</nowiki>

:[Pop-up window with green background.]
:Twitter for 18+ singles! Join today!
:Cueball: Does every porn site have to brand itself like this?
:<nowiki>*Close*</nowiki>

:[Pop-up window with blue background.]
:We're like Google Reader for S&M!
:Cueball: ''Really?''
:<nowiki>*Close*</nowiki>

:[Pop-up window with orange background.]
:Try the new GitHub for lesbians!
:Cueball: Ok, wait, what?

{{comic discussion}}
[[Category:Comics featuring Cueball]]
[[Category:Comics with color]]
[[Category:Internet]]
[[Category:Portmanteau]]
[[Category:Sex]]
[[Category:Social networking]]

560: Lithium Batteries

2014-05-09T18:26:39Z

108.162.219.29: /* Explanation */

{{comic
| number = 560
| date = March 25, 2009
| title = Lithium Batteries
| image = lithium_batteries.png
| titletext = I'm normally a pretty frugal person, but I still compulsively buy any R/C aircraft that's less than $30. In the last few years, this has become a problem.
}}

==Explanation==
[[Randall]] muses that his life would have been better if he aged in reverse; this idea is based on a timeline of the usage of {{w|Lithium-ion battery|lithium-ion batteries}}. The reasoning is that each of these uses would come to realization when he most needed it (i.e. cheap RC aircraft as a child, a phone when he is a successful businessman, a pacemaker when he is old, etc). The time-reversed aging is probably a direct reference to "{{w|The Curious Case of Benjamin Button (short story)|The Curious Case of Benjamin Button}}", by {{w|F. Scott Fitzgerald}}, a "major motion picture" of which was released in December 2008, a few months before this comic appeared. Randall has used this theme before in [[270: Merlin]], referencing another backward-time-travelling character (in that case, from "{{w|The Once and Future King}}" by {{w|T. H. White}}).

Lithium-ion batteries have the highest energy density of any widely available battery, and for this reason are commonly used in portable electronic devices such as laptops, tablets and smartphones, and also the newest airliners such as the {{w|Boeing 787 Dreamliner}}.

In the title text, Randall states that he is a big fan of cheap {{w|Radio-controlled aircraft|radio-controlled aircraft}} (now powered by cheap lithium-ion batteries), which he desperately wishes were available when he was a child and which undoubtedly were the inspiration for this comic. As such, he has an uncontrollable, instinctive urge to make up for his childhood lack of RC aircraft by buying every one he sees, which is becoming a huge financial problem as cheap RC aircraft become more and more plentiful.

==Transcript==
:Timeline of Commercial Uses of Lithium Batteries:
:[The panel has a timeline that goes from Past to Present. The timeline has 4 notches on it.]
:Past
:[the first notch, closest to the past side, has a picture of an old man with a walking stick.]
:Pacemakers
:[The second notch has an image of a man in a car, who is talking on his cell phone.]
:Phones for Rich Business People
:[The third notch, has a teen taking on his cellphone.]
:Phones for Teenagers
:[The forth notch, closest to the present on the timeline, and an image of a toy plane box with $10 written on it.]
:Really cheap r/c planes and helicopters
:Present
:[Below the main panel.]
:Life would be so much better if I was one of those people who aged backward.

{{comic discussion}}
[[Category:Comics featuring Cueball]]

505: A Bunch of Rocks

2014-05-08T22:29:29Z

108.162.219.29: /* Explanation */

{{comic
| number = 505
| date = November 17, 2008
| title = A Bunch of Rocks
| image = a_bunch_of_rocks.png
| titletext = I call Rule 34 on Wolfram's Rule 34.
}}

==Explanation==
{{incomplete|What is the diagram to the right of the Epitaph of Stevinus? Too many parentheses here, many items are not well explained. Language is still a major issue. This is a candidate for the "Incomplete explanation of the day."}}
[[Cueball]] awakens to find himself trapped for eternity in an endless expanse of sand and rocks. At first, he uses this time to derive all of mathematics and physics, including {{w|quantum mechanics}} and {{w|general relativity}}. The Swiss patent office line refers to {{w|Albert Einstein}}, who supposedly came up with the idea for general relativity while mundanely employed as a Swiss patent clerk.

Next, armed with infinite time and space (and rocks), Cueball uses the rocks to build a {{w|cellular automaton}}, a computational model based on simple rules to advance from one state to the next. Certain cellular automata are {{w|Turing-complete}}, which means that they can be used to represent any computer program (given finite-but-possibly-extremely-large time and space). He specifically seems to be running Wolfram's {{w|Rule 110}}, which is indeed capable of universal computation. Cueball then uses his enormous, hand-powered computer to simulate a universe.

When using Rule 110 for universal computation, one builds a background pattern, which can be seen in the comic (especially the "I was able to build a computer..." panel and the "The rows blur past..." panel) as the nigh-universal pattern of smaller triangles, and then performs computation by sending out "rockets" (the patterns of larger triangles seen in the "The rows blur past..." panel) to collide and interact with each other (for example, the triangular outlines in the "Sure, it's rocks instead of electricity..." panel).

The last panel then implies that the universe Cueball is simulating is, in fact, ''our'' universe. In the "I'm sorry, I must have missed a rock..." panel, Cueball mentions he must have made a mistake in the last "billions of billions of millenia." A millennium is a thousand years, which implies that the time needed to run this computer through a single step of computation is trillions of years. This means he spends much more time on a single step of computation than our universe has spent existing, and this single step of computation simulates an extremely short span of time (a {{w|Planck time}} most probably); to put this massive difference into perspective, our universe is around 13.772 billion years old, which corresponds to roughly 8.06*10^72 years of Cueball's computation. Suffice to say, this is a ''very'' long time.

The diagrams in the "Physics, too. I worked out the kinks..." panel are, from left to right: A {{w|Gaussian function}} (probably the {{w|Normal distribution}}); the {{w|Inclined plane#History|Epitaph of Stevinus}}; a weird diagram with lines in it (something to do with thermodynamic cycles?).

[[305: Rule 34|Rule 34]] is a humorous rule of the Internet which states "If you can imagine it, there is porn of it. No exceptions." {{w|Elementary cellular automaton#Random initial state|Wolfram's Rule 34}} is a cellular automaton. Randall is suggesting that someone should make pornography featuring the cellular automaton in question. This might prove to be quite challenging, as Wolfram's Rule 34 quickly devolves into a bunch of diagonal lines given almost any input.

==Transcript==
:[Cueball is walking alone in a desert, narrating his own situation.]
:So I'm stuck in this desert for eternity.
:I don't know why. I just woke up here one day.

:I never feel hungry or thirsty.

:I just walk.

:Sand and rocks

:stretch to infinity.
:As best as I can tell.

:[Cueball is sitting in the desert, in a contemplative position.]
:There's plenty of time for thinking out here.
:An eternity really.

:[Cueball is sketching stuff in the sand.]
:I've rederived modern math in the sand
:and then some.

:[Different graph types are depicted.]
:Physics too. I worked out the kinks in quantum mechanics and relativity.
:Took a lot of thinking, but this place has fewer distractions than a Swiss patent office.

:[Cueball is walking along the desert, laying out rocks.]
:One day I started laying down rows of rocks.

:[Cueball continues to deploy rocks.]
:Each new row followed from the last in a simple pattern.

:[Image continues to zoom out showing laid out rocks.]
:With the right set of rules and enough space,

:I was able to build a computer.
:Each new row of stones is the next iteration of the computation.

:Sure it's rocks instead of electricity, but it's the same* thing.
:Just slower.
:<nowiki>*Turing-complete</nowiki>

:[Cueball in contemplative pose.]
:After a while, I programmed it to be a physics simulator.

:[A particle labeled by binary strings.]
:Every piece of information about a particle was encoded as a string of bits written in the stones.

:[A [http://en.wikipedia.org/wiki/Feynman_diagram Feynman diagram] showing two particles interacting.]
:With enough time and space, I could fully simulate two particles interacting.

:[Cueball standing before the vastness of the desert.]
:But I have ''infinite'' time and space.

:[Depiction of various galaxies and other systems.]
:So I decided to simulate a universe.

:[Cueball is walking about his rocks, moving them around.]
:The eons blur past as I walk down a single row.

:[Zoom out of the rows of rocks.]
:The rows blur past to compute a single step.

:[Shows placement of two particles.]
:And in the simulation...

:[The two particles have moved; an after-image of their previous placement is present.]
:...another instant ticks by.

:[A person observes a mote of dust vanish.]
:So if you see a mote of dust vanish from your vision in a little flash or something

:[Cueball is holding two rocks, rearranging them.]
:I'm sorry. I must have misplaced a rock
:sometime in the last few billions and billions of millennia.

:[Cueball in front of the vastness of his infinite desert.]
:Oh and...

:[Cueball in a classroom setting with head in hands, girl and professor are present; there are apparently less than five minutes left in the class.]
:If you think the minutes in your morning lecture are taking a long time to pass for ''you''...

{{comic discussion}}
[[Category:Comics featuring Cueball]]
[[Category:Physics]]

1365: Inflation

2014-05-07T06:41:07Z

108.162.219.29: /* Explanation */ +links

{{comic
| number = 1365
| date = May 7, 2014
| title = Inflation
| image = inflation.png
| titletext = Wait till they notice the faint reflection of Michael Jordan and Bugs Bunny in the E-mode.
}}

==Explanation==
{{incomplete|Added a basic explanation. Still needs some work.}}
The comic is inspired by the recent {{w|BICEP2}} discovery of gravitational waves from the early universe, hence proving evidence for the {{w|Inflation (cosmology)|cosmic inflation}}ary hypothesis. Megan is excited about this and tells Ponytail all about it. She is impressed by the fact that the these waves were created when the universe was extremely small and the expanding universe has "imprinted" the gravity waves.

She compares this to the nature of a microscope - which optically expands a small image, just like the universe has done to itself. Ponytail is impressed by it until Megan looks at the actual image captured by the BICEP2 instrument. Since most {{w|cosmic microwave background}} images (due to the observable globe of the universe) are flattened into distorted ovals on paper, it looks much like a basketball, complete with {{w|Spalding (sports equipment)|Spalding}} company logo and name imprinted across it, along with the traditional curves that are visible on a basketball.

The concept of an expanding universe is often explained by comparing it with a basketball [https://books.google.nl/books?isbn=0691147310], where the leather skin represents our three-dimensional universe and the inflation of the ball represents expansion over time.

They are both disconcerted by this, and the title text references the 1996 film ''{{w|Space Jam}}'' by promising images of Michael Jordan and Bugs Bunny (more cultural icons) if the polarization of the view is changed to {{w|B-modes|E-mode}}.

==Transcript==

[Megan sits at a computer, conversing with Ponytail.]

Megan: Imprinted on the sky are the gravity waves that were sloshing across the universe when it was ''this'' big.

Megan: So really, we're using the entire universe as a giant microscope pointed at itself when it was small.

[Megan turns to face computer.]

Ponytail: That's neat.

Megan: Yeah. But...

Ponytail: But what?

Megan: Well, look.

Ponytail: Oh. Hmm.

Megan: Yeah.

Ponytail: What...

Megan: I don't know.

[Below is an infrared-esque image of the universe, featuring a series of circles and the Spalding logo, as though the universe had been imprinted with the image of a basketball.]

{{comic discussion}}

336: Priorities

2014-05-02T19:06:04Z

108.162.219.29: /* Explanation */

{{comic
| number = 336
| date = October 31, 2007
| title = Priorities
| image = priorities.png
| titletext = You should start giving out 'E's so I can spell FACADE or DEFACED.
}}

==Explanation==
In schools in the United States, a student's grades are determined mainly using letters for quick reference. In this case:

::A — 100%–90%
::B — 89%–80%
::C — 79%–70%
::D — 69%–60%
::F — 59%–0%

Traditionally, these schools send 'report cards' in which the student's current grading of the semester or even the entirety of the class the student is taking is denoted using these letters, for example:

::English — A
::Mathematics — A
::Science — A
::Social Studies — A
::World Building — A

The student may have noted that, if he aims for certain scoring (for example: altering the quality of his homework or even sending out his homework only at the times needed for his grades to reach a certain level), he could make the report card spell every letter grade in alphabetical order. Deriving from the previous example, the student would aim for the following report card:

::English — A
::Mathematics — B
::Science — C
::Social Studies — D
::World Building — F

Interestingly, since even a 0% grade would mark the required 'F' grade, the student does not need to work at all (not even send out a school assignment) to get the required 'F' grade, this leading to the situation presented in the comic above.

The title text references that, not only can the grades in the report card inadvertently spell out certain words (for example: 'CAB' or 'FAD'), but also that the letter grade system denoted omits the letter 'E' in standard letter grading. Note that the 'E' is not really missing; it only looks that way because the word 'FAIL' begins with the letter 'F'.

==Transcript==
:[A teacher is talking to a student, sitting at a desk.]
:Teacher: If you don't turn in at least one homework assignment, you'll fail this class.
:[The student holds up his report card.]
:Student: Yeah. But if I can fail this class, the grades on my report card will be in alphabetical order!

{{comic discussion}}
[[Category:Comics featuring Cueball]]

1363: xkcd Phone

2014-05-02T06:30:37Z

108.162.219.29: /* Explanation */ Do not taunt Happy Fun Phone!

{{comic
| number = 1363
| date = May 2, 2014
| title = xkcd Phone
| image = xkcd_phone.png
| titletext = Presented in partnership with Qualcomm, Craigslist, Whirlpool, Hostess, LifeStyles, and the US Chamber of Commerce. Manufactured on equipment which also processes peanuts. Price includes 2-year Knicks contract. Phone may extinguish nearby birthday candles. If phone ships with Siri, return immediately; do not speak to her and ignore any instructions she gives. Do not remove lead casing. Phone may attract/trap insects; this is normal. Volume adjustable (requires root). If you experience sudden tingling, nausea, or vomiting, perform a factory reset immediately. Do not submerge in water; phone will drown. Exterior may be frictionless. Prolonged use can cause mood swings, short-term memory loss, and seizures. Avert eyes while replacing battery. Under certain circumstances, wireless transmitter may control God.
}}

==Explanation==
{{incomplete|Created by a BOT - Please change this comment when editing this page.}}

This comic is a parody of a multitude of mobile-technology related issues that, when brought together, create a general satire of smartphone advertising. The advertised features here either make previously useful capabilities useless or add features nobody wants.

From bottom left, going clockwise:

Flightaware partnership - This is a parody of flight mode, a capability most smart phones have. When activated, flight mode disables all transmission and receiving capabilities, making the phone suitable for use while on commercial flights. Flightaware partnership, by contrast, is an intrusive presumably airline-sponsored capability that no one wants.

Realistic case– possibly a joke on various audiovisual devices like gaming consoles that advertise realistic sound, graphics, etc. Of course, applying "realistic" to an actual physical case is ridiculous. Either the case is actually real, or it doesn't actually function as a case.

Clear screen– This is a pointless descriptor from the perspective of the consumer. Of course the screen is clear. This joke works in tandem with the previous joke, as a play on "clear case, realistic screen," which are both hypothetically viable selling points.

Side Facing Camera – There was a recent controversy surrounding a kickstarter for a surreptitious, side-mounted camera device for smartphones due to the advertisement of the device as a good way to take creep shots, which are illegal in many places. Widespread dissemination of these devices as a built in would likely result in a sharp increase in delinquency of this nature.

Custom blend OS – iOS and Android are offered by different conglomerates and run on different kernels. A "custom blend" would probably be a nightmare to work with.

Simulates alternate speeds of light - This renders the clock useless. The speed of light is roughly 2.99x10^8 meters per second, far greater than 100 miles an hour. The adjustment for phone acceleration is also useless. While very high speeds can affect how time is perceived, normal daily use of a cellphone does not entail anything that would have a significant relativistic effect on the accuracy of clock time.

Wireless - as in cordless phone. This is the bare minimum a phone has to have in order to be a mobile phone, so advertising it as a feature feels dated by decades. Or, perhaps Munroe is implying the entire phone is without wires, in which case it wouldn't function.

Accelerometer screams in free fall– Another useless function. Rather than having some sort of feature to prevent breakage or cracking when a drop is detected, the phone just makes you more aware of its potential imminent doom.

When exposed to light, phone says "hi" - Bait and switch, and also a build from the previous joke. The implied feature is that the screen or camera will automatically adjust, but instead the phone is weirdly anthropomorphized.

The ominous warnings and disclaimers in the title text are probably a reference to the ''Saturday Night Live'' parody ad for {{w|Happy Fun Ball}}.

==Transcript==
{{incomplete transcript}}

{{comic discussion}}

293: RTFM

2014-05-01T21:11:54Z

108.162.219.29: /* Explanation */

{{comic
| number = 293
| date = July 23, 2007
| title = RTFM
| image = rtfm.png
| titletext = Life is too short for man pages, and occasionally much too short without them.
}}

==Explanation==
The title RTFM is an acronym for "{{w|RTFM|read the fucking manual}}", which frustrated software users tell users when confronted with a simple question (most likely answered in the manual).

However, [[Cueball]] encounters a similar situation with a {{w|911}} call, in which the first question the 911 dispatcher asks Cueball if has he read the toaster's {{w|man page}} (man pages are the 'manual' for unix systems, but only describe commands and library functions, not hardware). Even if a man page existed, it is unreasonable to require the user of a toaster to read the manual just to avoid being stabbed in the face. The 911 dispatcher decides that as he has not read the man page, Cueball is not entitled to medical assistance, and hangs up.
The title text refers to the popular phrase "Life's too short", which asserts that because we only have a fixed amount of time on Earth, and that time can pass by quickly, we should make the most of it. That could mean, for example, don't spend time reading the documentation unless you actually experience a problem. The second part alludes to the fact that some people actually die because they didn't RTFM!

==Transcript==
:[Cueball with a knife sticking out of his heavily bleeding face stands in front of a toaster, which has an arm extending from the top of it. He is holding a telephone to his ear.]
:Cueball: Hello, 911? I just tried to toast some bread, and the toaster grew an arm and stabbed me in the face!
:911: Did you read the toaster's man page first?
:Cueball: Well, no, but all I wanted was--
:911: ''click''

{{comic discussion}}
[[Category:Comics featuring Cueball]]
[[Category:Comics with color]]

1361: Google Announcement

2014-04-28T06:52:58Z

108.162.219.29: /* Transcript */ hyphens -> em-dashes

{{comic
| number = 1361
| date = April 28, 2014
| title = Google Announcement
| image = google_announcement.png
| titletext = The less popular 8.8.4.4 is slated for discontinuation.
}}

==Explanation==
{{incomplete|I'm sure there's more to the DNS thing.}}

Recently Vic Gundotra left Google. Being the head of Google+, this has caused many people, including [http://techcrunch.com/2014/04/24/google-is-walking-dead/ TechCrunch], to theorize that Google+ is going to be shutdown, despite the continuing comments from Google that it will remain active and updated.

The comic extrapolates this to an announcement that Google would be closing *all* its popular services, up to and including its e-mail service Gmail and even the core business of the company, its Internet search engine, to wholly concentrate on a relatively recent addition to its product lineup. According to Google, its Public DNS servers, better known by their IPv4 addresses 8.8.8.8 and 8.8.4.4, are supposed to be a faster (because of caching effects due to a large user base) alternative to using one's ISP's DNS servers, as well as less susceptible to censorship. When Turkey started blocking access to Twitter and YouTube recently, Turkish ISPs first did this on the DNS level by manipulating the results from their name servers. The most popular workaround was using Google's DNS server instead.

The joke may also be related to the fact that 8.8.8.8 is an IP address heavily used by network administrators to perform connectivity tests (''ping'') because it is easy to remember and fast to type. Google would want to concentrate on this feature to build a business model using that fact.

The reason behind this decision may be that Google considers a DNS server, a fairly low-level component of the Internet's service stack, to be the optimal place to collect information on its users, an accusation leveled at Google ever since it introduced the service.

The title text refers to the impression held by some that Google will shut down services that prove less popular than desired at short notice, even though they may in fact have a significant user base. A recent example of that is the closure of the RSS aggregation service, Google Reader, in July 2013. While the same DNS service is provided under both addresses, the more memorable 8.8.8.8 is likely to receive far more requests than 8.8.4.4.

==Transcript==
:[Cueball is standing at a podium marked Google.]

:Cueball: The rumors are true. Google will be shutting down Plus—

:Cueball: Along with Hangouts, Photos, Voice, Docs, Drive, Maps, Gmail, Chrome, Android, and Search—

:Cueball: To focus on our core project:

:Cueball: The 8.8.8.8 DNS Server.

{{comic discussion}}

826: Guest Week: Zach Weiner (SMBC)

2014-04-09T13:29:37Z

108.162.219.29: /* The Hall of Misunderstood Science */ "proteins"->"nucleotides" (though "nucleobases" might be more accurate)

{{comic
| number = 826
| date = November 26, 2010
| title = Guest Week: Zach Weiner (SMBC)
| image = guest week zach weiner smbc.png
| titletext = Guest comic by Zach Weiner of Saturday Morning Breakfast Cereal. When I was stressed out, Zach gave me a talk that was really encouraging and somehow involved nanobots.
}}

==Explanation==
{{incomplete|Not all sections are explained, maybe a picture for each should be posted here.}}
This comic is guest drawn by Zach Weiner, author of the webcomic [http://www.smbc-comics.com/ Saturday Morning Breakfast Cereal]. It's interactive, so you'll have to see the [http://www.xkcd.com/826/ original comic].

The entire comic is a hypothetical "{{w|Smithsonian Museum}} of Dad-Trolling, an entire building dedicated to deceiving children for amusement." That explains it pretty well.

===The Hall of Misunderstood Science===
Each exhibit is a display set up to reinforce the false answers to typical questions that children may ask their fathers about scientific topics. The answers given involve just enough information that the child may be satisfied with the answer and repeat it to others while maintaining the irony for adults that the answers are obviously misleading or false.

[[File:Hall Of Misunderstood Science 1.png|frame|center|
'''Top-left:''' The basilisk is a mythological reptilian monster that was described with the ability to turn other living things to stone with its gaze. 
'''Top-right:''' The magnet exhibit alludes to a loss of sexual desire in adults that while perceived may not be true. 
'''Bottom-left:''' Jesus' dandruff as snow refers to a common idiom in English that rain is "god's tears" and proposes a humorous and irreverent extension of the saying. 
'''Bottom-right:''' The sleep exhibit reinforces common fears by accentuating the aspect of vulnerability associated with sleep.
]]

[[File:Hall Of Misunderstood Science 2.png|frame|center|
'''Top-left:''' Water is less dense as a solid than it is when in liquid state. This is an unusual property as most materials are more dense in solid form. The exhibit falsely explains the phenomenon by linking it to a defense mechanism employed by prey species to deter predators. A rhinoceros, though fierce and territorial, is not a predator. 
'''Top-right:''' The anti- in anti matter is a prefix in English which means "the opposite of" referring to the fact that antimatter is made up of oppositely charged particles from regular matter. This is a partial homonym to species of insects commonly called ants. 
'''Bottom-left:''' The letters associated with DNA are related to the nucleotides which make up the chains, they are guanine, adenine, thymine, and cytosine. The commonality of the abbreviation disguises the link to the names of the nucleotides and gives rise questions regarding the letter choices. 
'''Bottom-right:''' The figure speaking about molecule display is displaying a common trope attributed to elderly men in that they complain about developments that change the way the view or interact with the world. Historically, though it was understood that matter was made up of small particles it was a common misnomer to refer to these particle as atoms.
]]

===Regrettable Pranks: An Interactive Experience===
This section holds falsehoods that a dad might use to frighten his children. It is an interactive experience, so visitors can try something for themselves, then learn the frightening fact it indicates.

Helium makes your voice high-pitched, which visitors are told is a sign they are about to explode.

Your middle finger is always longer than the others, so this test will always tell visitors they are an alien half-breed.

Cherries are a common ingredient in Jello cups, but the exhibit implies that the cherry is actually a rabbit brain.

===Concessions===

===Conservatory of Poorly Remembered History===

===Rotunda of Uncomfortable Topics===
The "naked wrestling" appears to be sex.

The "big tummies before babies come" obviously refers to pregnancy.

Sidestepping around the death of a loved one is common with young children to spare them the sorrow of death; this takes it a step further by saying that the child's grandmother went to Saturn.

===Miscellaneous===
The Bathrooms have 3 doors. Clicking reveals that there is one for each gender of humans, and one for "Korgmen & Spangs".

==Transcript==
:In the spirit of xkcd I present a proposal for a new Smithsonian museum:
:The Smithsonian Museum Of Dad-Trolling
:An entire building dedicated to deceiving children for amusement

:(Click to view exhibits!)

:The top left room is 'The Hall of Misunderstood Science'. It contains six exhibits.

:Exhibit: A giant basilisk looms over children.
:Exhibit label: BASILISKS: Real, deadly, under your bed.

:Exhibit: Four magnets hang from a square arch. A child is touching two of them together.
:Text on the arch: Magnets only leap at each other when they're teenagers. Later, they lose interest.

:Exhibit: A child on his dad's shoulders looks up at a looming statue of Jesus behind a lectern. There are flakes falling from Jesus onto them both.
:Exhibit label: Snow is Jesus' dandruff. His scalp gets dry when it's cold.

:Exhibit: A child lies asleep, while hands and a scary face reach up around the bed toward him.
:Exhibit label: Sleep: Now you're vulnerable to the boogie man!

:Exhibit: An ice block sits on a stand in front of pictures of a wolf and rhinoceros looking frightened.
:Exhibit label: Freezing water: Expands to frighten predators.

:Exhibit: An insect on a stick is orbited by a small sphere.
:Exhibit label: Anti-matter: Matter that is more than 50% ants.

:Exhibit: A DNA strand with the letters T, A, C, and G hanging around it.
:Exhibit label: DNA only has four letters because the alphabet was smaller back then.
:Dad, to child: Told you so.

:Exhibit: A bunch of molecules hang from the ceiling.
:Exhibit label: Molecules? In my day, we only had atoms!

:The top right room is 'Regrettable Pranks: An Interactive Experience'. There are four exhibits.

:Exhibit: Five balloons float tethered to a table. A child is holding a sixth balloon. The Dad looks alarmed.
:Sign on exhibit: If this helium makes your voice go higher, it's because you're ten seconds from exploding.

:Exhibit: An alien face is shown above an outline of several hands next to a ruler. A child holds his hand up to it.
:Sign on exhibit: Measure your middle finger. If it's longer than the others, you're an alien halfbreed.

:Exhibit: Three cups are on a table. A child is walking away with a fourth cup, the dad's arm around the child's shoulder.
:Exhibit label: Has anyone seen my rabbit brain? It looks like a cherry, and I dropped it in a Jello cup.

:Exhibit: A monstrous set of jaws open upward around a bed.
:Sign on exhibit: Make your bed or monsters will know a kid lives there.

:The center right room is 'Concessions'. There are three booths.

:Booth: A concession stand is labeled 'KFP', and displays a KFC-style bucket. A dad and child are eating.
:Dad: The "P" is for "phoenix".

:Booth: A concession stand.
:Sign on stand: Ground beef: Beef we found on the ground.
:Dad, to child: Told you.

:Booth: A stand shaped like a giant eye.
:Booth label: EYES CREAM
:Subtitle: How did you think it was spelled?
:Sign on booth: Now with more of the goo in your eyes. Same as every other creamery.

:The lower left room is 'Conservatory of Poorly Remembered History'. There are five exhibits.

:Exhibit: A man is riding a dragon.
:Exhibit label: Genghis Khan: victory through dragons.

:Exhibit: A criminal in front of some windows.
:Exhibit label: The Crimean War: The first war against crime.

:Exhibit: A castle with flags hanging on it.
:Exhibit label: The Renaissance
:Subtitle: Long story short, the wizards were in control.

:Exhibit:A man in Jedi-style robes with a fake beard.
:Exhibit label: Star Wars is a documentary. No, seriously.
:Dad, to children: Kids, this man is a veteran.

:The lower right room is 'Rotunda of Uncomfortable Topics'. There are five exhibits.

:Exhibit: A wrestling ring, with a man and woman mostly obscured by the exhibit label.
:Exhibit label: Naked wrestling: perfectly normal. NEVER DO IT.

:Exhibit: a figure sits at a booth in front of a bowl of food. The dad is holding a bottle.
:Exhibit label: Alcohol is poison. I drink to save you from it.
:Dad: You're welcome.

:Exhibit: A large bird.
:Exhibit label: Mommies get big tummies before babies come because the stork likes chubby girls.

:Exhibit: A rocket ship.
:Sign on exhibit: Grandma's not dead. She just returned to Saturn. For REVENGE.

:In the areas outside the rooms, there are two more exhibits and restrooms, all clickable.

:Exhibit: A dinosaur skeleton.
:Exhibit label: That's right. Dinosaurs were made entirely of BONES.
:Dad, to kid: If you think about it, it makes sense.

:Exhibit: A large image hangs on the wall. It is a dense squiggly jumble of lines.
:Dad, to kids: You gotta squint juuust right.
:Sign on exhibit: Magic eye trick that doesn't actually work.

:Restrooms: There are three doors, each with a sign.
:First door (male logo): Men & Boys
:Second door (female logo): Women & Girls
:Third door (unrecognizable logo): Korgmen & Spangs

{{comic discussion}}
[[Category:Comics featuring Cory Doctorow]]
[[Category:Comics featuring real people]]
[[Category:Comics with color]]
[[Category:Ferret]]
[[Category:Guest Week]]
[[Category:Interactive comics]]
[[Category:Dinosaurs]]
[[Category:LOTR]]
[[Category:Religion]]
[[Category:Science]]
[[Category:Star Wars]]

1353: Heartbleed

2014-04-09T08:17:10Z

108.162.219.29: templatized wikipedia links

{{comic
| number = 1353
| date = April 9, 2014
| title = Heartbleed
| image = heartbleed.png
| titletext = I looked at some of the data dumps from vulnerable sites, and it was ... bad. I saw emails, passwords, password hints. SSL keys and session cookies. Important servers brimming with visitor IPs. Attack ships on fire off the shoulder of Orion, c-beams glittering in the dark near the Tannhäuser Gate. I should probably patch OpenSSL.
}}

==Explanation==
"Heartbleed" refers to a critical bug in the OpenSSL security library. This bug was publicly released on Monday, april 7th.
Due to a programming error in OpenSSL versions 1.0.1 through 1.0.1f (inclusive), attackers could read random server memory by sending specially prepared heartbeat signals to an affected server.
This exploit allows attackers to obtain random pieces of information, including, but not limited to, the servers private key(!!!), in-memory passwords, contents of open files, and much more.
More information is available at [http://heartbleed.com heartbleed.com] or under CVE-2014-0160, [https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0160 CVE-2014-0160 at nvd.nist.gov]

This bug is classified as extremely critical due to the potential of unveiling the servers private key, enabling anyone to impersonate the server and/or decrypt all traffic to it (unless "perfect forward secrecy" ciphers is used, which is currently rare).
Furthermore, because the exploit occurs in the handshake phase of setting up a connection, no traces of it are logged.
I.E. You can be attacked and never be the wiser.

The mouseover text cites the {{w|Tears in rain soliloquy}}, the dying words of the replicant and main antagonist Roy Batty (played by {{w|Rutger Hauer}}) in the 1982 film ''{{w|Blade Runner}}''.

==Transcript==
:Megan: Heartbleed must be the worst web security lapse ever.
:Cueball: Worst so far. Give us time.
:Megan: I mean, this bug isn't just broken encryption.
:Megan: It lets website visitors make a server dispense random memory contents.
:Megan: It's not just keys. It's traffic data. Emails. Passwords. Erotic faniction.
:Cueball: Is '''everything''' compromised?
:Megan: Well, the attack is limited to data stored in computer memory.
:Cueball: So paper is safe. And clay tablets.
:Megan: Our imaginations, too.
:Cueball: See, we'll be fine.

{{comic discussion}}

Talk:1352: Cosmologist on a Tire Swing

2014-04-07T10:57:51Z

108.162.219.29: first panel?

See this TED talk for clue: http://www.ted.com/talks/allan_adams_the_discovery_that_could_rewrite_physics
[[Special:Contributions/108.162.218.101|108.162.218.101]] 07:54, 7 April 2014 (UTC)

The question "what lies outside our observable universe?" is pretty easily answered with a "the same stuff as inside it, we just can't observe it". The more poignant question is whether the universe as a whole (not just its observable part) has an edge and if so, what lies beyond it. --[[User:Koveras|Koveras]] ([[User talk:Koveras|talk]]) 08:09, 7 April 2014 (UTC)

:The parts of universe which are not observable due to speed of light looks the same as the ones we can observe, sure. Just bigger. But there is nothing in physics saying there can't be something even more "outside". In fact, some theories consider it probable. And what can be THERE? Anything. Dragons. Possibly literally. Unfortunately, according to current physic, we can't PROVE something outside exists, much less look at it. -- [[User:Hkmaly|Hkmaly]] ([[User talk:Hkmaly|talk]]) 10:21, 7 April 2014 (UTC)

What's the setting of the first panel? Given the cosmological context, could it be a reference to the {{w|Wood between the Worlds}} from the ''Narnia'' series? [[Special:Contributions/108.162.219.29|108.162.219.29]] 10:57, 7 April 2014 (UTC)

1286: Encryptic

2013-11-14T21:58:13Z

108.162.219.29: /* Passwords */

{{comic
| number = 1286
| date = November 4, 2013
| title = Encryptic
| image = encryptic.png
| titletext = It was bound to happen eventually. This data theft will enable almost limitless [xkcd.com/792]-style password reuse attacks in the coming weeks. There's only one group that comes out of this looking smart: Everyone who pirated Photoshop.
}}

==Explanation==
Web sites and other computers that authenticate users via passwords need to be able to know if the user typed in the right password. But storing the password itself on the computer has been known to be unnecessarily risky since the publication of [http://www.neurosecurity.com/articles/security/passwd.pdf Password Security: A Case History] in 1978. In that paper, Robert Morris and Ken Thompson demonstrated the practice of using a slow, cryptographically-secure one-way {{w|Hash function|hash function}}, so that even if the password file is stolen, it will be very hard to figure out what the passwords are, so long as the passwords themselves are suitably complex. They also pioneered the use of {{w|Salt (cryptography)|a “salt”}} which makes each password hash completely different even if two users use the same password. See [http://security.blogoverflow.com/2011/07/a-tour-of-password-questions-and-answers/ A tour of password questions and answers] for background on salts and suitably slow hash functions.

Adobe, however, ignored these well-known principles, and instead stored over a hundred million passwords in a reversably encrypted way, using a terrible choice of encryption methods which exposes a great deal of information about the passwords, and does not involve a salt. This password database was recently obtained by someone and released on the Internet.

In particular, Adobe used {{w|Triple DES}}, an older encryption algorithm which can still be relatively secure when properly used but they used it improperly. It works on 64-bit (8 character) blocks. Assuming that the passwords are stored in plain ASCII, this means that a sequence of 8 characters in a password which starts on a character position which is a multiple of eight is always encrypted to the same result. Therefore two passwords starting with “12345678” would start with the same block after being encrypted. Furthermore, this means that you can actually get a very good idea of the length of the password since anything with only one block is a password with length between 1 and 8 characters, and having two blocks implies it has between 9 and 16 characters, etc.

Adobe also stored hints users created for their passwords. That means that an attacker knows not only if the same 8 characters are used for multiple passwords but also has some hints for guessing them. That means that common password portions should be easy to recover and that any user may be “compromised” by someone else using a part of the same password and providing a good hint. As an example, a password having three hints “Big Apple”, “Twin Towers” and “If you can make it there” is probably “New York” (or a simple variation on that). The weakness here is that no decryption and therefore no hard cracking has to take place, you just group the passwords by their encrypted blocks and try to solve them like a crossword puzzle. These weaknesses have already been used to presumably identify a password used by {{w|Edward Snowden}}, as discussed at [http://7habitsofhighlyeffectivehackers.blogspot.com/2013/11/can-someone-be-targeted-using-adobe.html 7 Habits of Highly Effective Hackers: Can someone be targeted using the Adobe breach?].

The examples are not taken from the actual leaked file, since that [http://arstechnica.com/security/2013/11/how-an-epic-blunder-by-adobe-could-strengthen-hand-of-password-crackers/ uses a different format], and the examples are evidently cleverly crafted to make a nice crossword-like puzzle, which can be solved as shown in the Passwords section below.

As mentioned on http://filosottile.github.io/analyzing-the-adobe-leaked-passwords/ the data in the comic isn't real and contains a hidden message.
If the "user password" hashes are Base64 encoded, they read:
<pre>ThiswasnotagooduseofyourtimeButthenagainitwasprobablynotagooduseofmytimeeith
erAndyethereweareXOXOXOLetsLiveHereInThisTinySecretEncodedTextWorldForever==</pre>

E.g., with the initial unique hash blocks: <tt>python -c "print '4e18acc1ab27a2d6a0a2876eb1ea1fca'.decode('hex_codec').encode('base64')"</tt>

The last letter "r" is not fully encoded in the data shown, but any letter from "g" to "v" produces the same binary data.

The title text makes a reference to a previous comic: [[792|Black Hat’s trouble with what to do with stolen passwords]]. It also states that users of pirated Photoshop are the winners here. This is because in order to make Photoshop pirate-able, it was modified (cracked) by removing the requirement for registration so their passwords were not sent to Adobe and therefore are not present in the leaked file.

The title itself is a reference to [http://en.wikipedia.org/wiki/Cryptic_crossword cryptic crosswords]

==Passwords==
Note that characters in the passwords could be upper or lower case, and they may involve common substitutions like "0" (number zero) for "O" (letter O); therefore, the clues cannot guarantee that the answer shown here is precisely correct. Nevertheless, we have plenty of information for a brute force attack.

{|class="wikitable"
! Input
! Hint
! Password
! Explanation
|-
|<tt>4e18acc1ab27a2d6</tt>
|weather vane sword
|<tt>[http://redwall.wikia.com/wiki/Matthias matthias]</tt>
|In ''{{w|Redwall}}'', several characters are associated with a sword hung from a weather vane, but only Matthias shares the name of an apostle (6 lines down).
|-
|<tt>4e18acc1ab27a2d6</tt>
|
|<tt>matthias</tt>
|Although no hint was used, we know this password too, since it matches the previous one.
|-
|<tt>4e18acc1ab27a2d6 a0a2876eb1ea1fca</tt>
|name1
|<tt>matthias1</tt>
|Even without knowing the user's name, we already know how this starts, so the clue gives us a pretty good idea how it finishes (and another block useful 2 lines down)
|-
|<tt>8babb6299e06eb6d</tt>
|duh
|<tt>password</tt>
|Unfortunately, this is all too common, and the user practically told us that it's an easy one.
|-
|<tt>8babb6299e06eb6d a0a2876eb1ea1fca</tt>
|
|<tt>password1</tt>
|Although no hint was used, we know this by combining the previous two.
|-
|<tt>8babb6299e06eb6d 85e9da81a8a78adc</tt>
|57
|<tt>password57</tt>
|Since we know how this begins, this is a good guess.
|-
|<tt>4e18acc1ab27a2d6</tt>
|favorite of {{w|Apostle_(Christian)|12 apostles}}
|<tt>{{w|Saint_Matthias|matthias}}</tt>
|This has only 12 possibilities to begin with (plus variant spellings, variant lists, and one replacement), but actually we know already which one by combining with the clue 6 lines up. (Surprise: it's the replacement!)
|-
|<tt>1ab29ae86da6e5ca 7a2d6a0a2876eb1e</tt>
|with your own hand you have done all this
|<tt>Judith1510</tt>
|This is a quotation from [http://www.biblestudytools.com/nrsa/judith/15-10.html Judith 15:10] in the Bible.
|-
|<tt>a1f9b2b6299e7a2b eadec1e6ab797397</tt>
|sexy earlobes
|<tt>{{w|Charlie_Sheen|Charlie Sheen}}</tt>
|This refers to an episode of ''{{w|Two and a Half Men}}''. Other answers are possible, but only this one fits the next line.
|-
|<tt>a1f9b2b6299e7a2b 617ab0277727ad85</tt>
|best TOS episode
|<tt>{{w|Charlie_X|Charlie X}}</tt>
|"{{w|Star_Trek:_The_Original_Series|TOS}}" refers to the original series of ''{{w|Star Trek}}''. Although this had dozens of episodes, only one fits the previous line as well as the next line.
|-
|<tt>39738b7adb0b8af7 617ab0277727ad85</tt>
|Sugarland
|<tt>HoustonTX</tt>
|{{w|Sugar_Land,_Texas|Sugarland}} is a suburb of {{w|Houston}}, {{w|Texas}}. This fits with the previous line.
|-
|<tt>1ab29ae86da6e5ca</tt>
|name + jersey#
|<tt>Judith15</tt>
|Even if we knew this user's name, we wouldn't know their jersey number. But the clue 4 lines up already gave us the answer.
|-
|<tt>877ab7889d3862b1</tt>
|alpha
|<tt>abc</tt>
|This password is also far too common, but this clue still isn't enough to narrow it down. Combine with the clue 4 lines below, however, and it's quite easy.
|-
|<tt>877ab7889d3862b1</tt>
|
|<tt>abc</tt>
|No hint, but the same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|
|<tt>abc</tt>
|No hint, but the same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|obvious
|<tt>abc</tt>
|Same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|Michael Jackson
|<tt>abc</tt>
|{{w|Michael Jackson}} did many songs, but only one was {{w|ABC_(song)|alphabetical}} (4 lines up).
|-
|<tt>38a7c9279cadeb44 9dca1d79d4dec6d5</tt>
|
|<tt>asdfghjkl</tt>
|No hint, but the same as the one below.
|-
|<tt>38a7c9279cadeb44 9dca1d79d4dec6d5</tt>
|he did the mash, he did the
|<tt>asdfghjkl</tt>
|Probably a "keyboard mash" (e.g. asdfghjkl), a common password. The hint is a reference to the song "{{w|Monster Mash}}" ("He did the mash/He did the monster mash").
|
|-
|<tt>38a7c9279cadeb44</tt>
|purloined
|<tt>asdfghjk</tt>
|A reference to the Edgar Allen Poe story "{{w|The Purloined Letter}}", this represents all the keys of the home row, or the keyboard mash password, but with one missing("purloined") letter.
|-
|<tt>a8ae5745a2b7af7a 9dca1d79d4dec6d5</tt>
|fav water-3 {{w|List_of_Pokémon|Pokemon}}
|<tt>[http://bulbapedia.bulbagarden.net/wiki/Tentacool_(Pok%C3%A9mon) Tentacool]</tt>
|This is the only [http://bulbapedia.bulbagarden.net/wiki/Water_3_%28Egg_Group%29 water-3] Pokémon with a 9 letter name ending in "l", so it must be this to fit with the password 'asdfghjkl'
|-
|}

==Transcript==
:Hackers recently leaked '''''153 million''''' Adobe user emails, encrypted passwords, and password hints.
:Adobe encrypted the passwords improperly, misusing block-mode 3DES. The result is something wonderful:

<pre>
User password Hint
------------- ----

4e18acc1ab27a2d6 weather vane sword
4e18acc1ab27a2d6
4e18acc1ab27a2d6 a0a2876eb1ea1fca name1
8babb6299e06eb6d duh
8babb6299e06eb6d a0a2876eb1ea1fca
8babb6299e06eb6d 85e9da81a8a78adc 57
4e18acc1ab27a2d6 favorite of 12 apostles
1ab29ae86da6e5ca 7a2d6a0a2876eb1e with your own hand you
have done all this
a1f9b2b6299e7a2b eadec1e6ab797397 sexy earlobes
a1f9b2b6299e7a2b 617ab0277727ad85 best tos episode
39738b7adb0b8af7 617ab0277727ad85 sugarland
1ab29ae86da6e5ca name + jersey#
877ab7889d3862b1 alpha
877ab7889d3862b1
877ab7889d3862b1
877ab7889d3862b1 obvious
877ab7889d3862b1 Michael Jackson
38a7c9279cadeb44 9dca1d79d4dec6d5
38a7c9279cadeb44 9dca1d79d4dec6d5 he did the mash, he did the
38a7c9279cadeb44 purloined
a8ae5745a2b7af7a 9dca1d79d4dec6d5 fav water-3 pokemon
</pre>

:The greatest crossword puzzle in the history of the world

{{comic discussion}}

[[Category:Comics with color]]
[[Category:Pokémon]]

1286: Encryptic

2013-11-14T21:57:41Z

108.162.219.29: /* Passwords */

{{comic
| number = 1286
| date = November 4, 2013
| title = Encryptic
| image = encryptic.png
| titletext = It was bound to happen eventually. This data theft will enable almost limitless [xkcd.com/792]-style password reuse attacks in the coming weeks. There's only one group that comes out of this looking smart: Everyone who pirated Photoshop.
}}

==Explanation==
Web sites and other computers that authenticate users via passwords need to be able to know if the user typed in the right password. But storing the password itself on the computer has been known to be unnecessarily risky since the publication of [http://www.neurosecurity.com/articles/security/passwd.pdf Password Security: A Case History] in 1978. In that paper, Robert Morris and Ken Thompson demonstrated the practice of using a slow, cryptographically-secure one-way {{w|Hash function|hash function}}, so that even if the password file is stolen, it will be very hard to figure out what the passwords are, so long as the passwords themselves are suitably complex. They also pioneered the use of {{w|Salt (cryptography)|a “salt”}} which makes each password hash completely different even if two users use the same password. See [http://security.blogoverflow.com/2011/07/a-tour-of-password-questions-and-answers/ A tour of password questions and answers] for background on salts and suitably slow hash functions.

Adobe, however, ignored these well-known principles, and instead stored over a hundred million passwords in a reversably encrypted way, using a terrible choice of encryption methods which exposes a great deal of information about the passwords, and does not involve a salt. This password database was recently obtained by someone and released on the Internet.

In particular, Adobe used {{w|Triple DES}}, an older encryption algorithm which can still be relatively secure when properly used but they used it improperly. It works on 64-bit (8 character) blocks. Assuming that the passwords are stored in plain ASCII, this means that a sequence of 8 characters in a password which starts on a character position which is a multiple of eight is always encrypted to the same result. Therefore two passwords starting with “12345678” would start with the same block after being encrypted. Furthermore, this means that you can actually get a very good idea of the length of the password since anything with only one block is a password with length between 1 and 8 characters, and having two blocks implies it has between 9 and 16 characters, etc.

Adobe also stored hints users created for their passwords. That means that an attacker knows not only if the same 8 characters are used for multiple passwords but also has some hints for guessing them. That means that common password portions should be easy to recover and that any user may be “compromised” by someone else using a part of the same password and providing a good hint. As an example, a password having three hints “Big Apple”, “Twin Towers” and “If you can make it there” is probably “New York” (or a simple variation on that). The weakness here is that no decryption and therefore no hard cracking has to take place, you just group the passwords by their encrypted blocks and try to solve them like a crossword puzzle. These weaknesses have already been used to presumably identify a password used by {{w|Edward Snowden}}, as discussed at [http://7habitsofhighlyeffectivehackers.blogspot.com/2013/11/can-someone-be-targeted-using-adobe.html 7 Habits of Highly Effective Hackers: Can someone be targeted using the Adobe breach?].

The examples are not taken from the actual leaked file, since that [http://arstechnica.com/security/2013/11/how-an-epic-blunder-by-adobe-could-strengthen-hand-of-password-crackers/ uses a different format], and the examples are evidently cleverly crafted to make a nice crossword-like puzzle, which can be solved as shown in the Passwords section below.

As mentioned on http://filosottile.github.io/analyzing-the-adobe-leaked-passwords/ the data in the comic isn't real and contains a hidden message.
If the "user password" hashes are Base64 encoded, they read:
<pre>ThiswasnotagooduseofyourtimeButthenagainitwasprobablynotagooduseofmytimeeith
erAndyethereweareXOXOXOLetsLiveHereInThisTinySecretEncodedTextWorldForever==</pre>

E.g., with the initial unique hash blocks: <tt>python -c "print '4e18acc1ab27a2d6a0a2876eb1ea1fca'.decode('hex_codec').encode('base64')"</tt>

The last letter "r" is not fully encoded in the data shown, but any letter from "g" to "v" produces the same binary data.

The title text makes a reference to a previous comic: [[792|Black Hat’s trouble with what to do with stolen passwords]]. It also states that users of pirated Photoshop are the winners here. This is because in order to make Photoshop pirate-able, it was modified (cracked) by removing the requirement for registration so their passwords were not sent to Adobe and therefore are not present in the leaked file.

The title itself is a reference to [http://en.wikipedia.org/wiki/Cryptic_crossword cryptic crosswords]

==Passwords==
Note that characters in the passwords could be upper or lower case, and they may involve common substitutions like "0" (number zero) for "O" (letter O); therefore, the clues cannot guarantee that the answer shown here is precisely correct. Nevertheless, we have plenty of information for a brute force attack.

{|class="wikitable"
! Input
! Hint
! Password
! Explanation
|-
|<tt>4e18acc1ab27a2d6</tt>
|weather vane sword
|<tt>[http://redwall.wikia.com/wiki/Matthias matthias]</tt>
|In ''{{w|Redwall}}'', several characters are associated with a sword hung from a weather vane, but only Matthias shares the name of an apostle (6 lines down).
|-
|<tt>4e18acc1ab27a2d6</tt>
|
|<tt>matthias</tt>
|Although no hint was used, we know this password too, since it matches the previous one.
|-
|<tt>4e18acc1ab27a2d6 a0a2876eb1ea1fca</tt>
|name1
|<tt>matthias1</tt>
|Even without knowing the user's name, we already know how this starts, so the clue gives us a pretty good idea how it finishes (and another block useful 2 lines down)
|-
|<tt>8babb6299e06eb6d</tt>
|duh
|<tt>password</tt>
|Unfortunately, this is all too common, and the user practically told us that it's an easy one.
|-
|<tt>8babb6299e06eb6d a0a2876eb1ea1fca</tt>
|
|<tt>password1</tt>
|Although no hint was used, we know this by combining the previous two.
|-
|<tt>8babb6299e06eb6d 85e9da81a8a78adc</tt>
|57
|<tt>password57</tt>
|Since we know how this begins, this is a good guess.
|-
|<tt>4e18acc1ab27a2d6</tt>
|favorite of {{w|Apostle_(Christian)|12 apostles}}
|<tt>{{w|Saint_Matthias|matthias}}</tt>
|This has only 12 possibilities to begin with (plus variant spellings, variant lists, and one replacement), but actually we know already which one by combining with the clue 6 lines up. (Surprise: it's the replacement!)
|-
|<tt>1ab29ae86da6e5ca 7a2d6a0a2876eb1e</tt>
|with your own hand you have done all this
|<tt>Judith1510</tt>
|This is a quotation from [http://www.biblestudytools.com/nrsa/judith/15-10.html Judith 15:10] in the Bible.
|-
|<tt>a1f9b2b6299e7a2b eadec1e6ab797397</tt>
|sexy earlobes
|<tt>{{w|Charlie_Sheen|Charlie Sheen}}</tt>
|This refers to an episode of ''{{w|Two and a Half Men}}''. Other answers are possible, but only this one fits the next line.
|-
|<tt>a1f9b2b6299e7a2b 617ab0277727ad85</tt>
|best TOS episode
|<tt>{{w|Charlie_X|Charlie X}}</tt>
|"{{w|Star_Trek:_The_Original_Series|TOS}}" refers to the original series of ''{{w|Star Trek}}''. Although this had dozens of episodes, only one fits the previous line as well as the next line.
|-
|<tt>39738b7adb0b8af7 617ab0277727ad85</tt>
|Sugarland
|<tt>HoustonTX</tt>
|{{w|Sugar_Land,_Texas|Sugarland}} is a suburb of {{w|Houston}}, {{w|Texas}}. This fits with the previous line.
|-
|<tt>1ab29ae86da6e5ca</tt>
|name + jersey#
|<tt>Judith15</tt>
|Even if we knew this user's name, we wouldn't know their jersey number. But the clue 4 lines up already gave us the answer.
|-
|<tt>877ab7889d3862b1</tt>
|alpha
|<tt>abc</tt>
|This password is also far too common, but this clue still isn't enough to narrow it down. Combine with the clue 4 lines below, however, and it's quite easy.
|-
|<tt>877ab7889d3862b1</tt>
|
|<tt>abc</tt>
|No hint, but the same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|
|<tt>abc</tt>
|No hint, but the same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|obvious
|<tt>abc</tt>
|Same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|Michael Jackson
|<tt>abc</tt>
|{{w|Michael Jackson}} did many songs, but only one was {{w|ABC_(song)|alphabetical}} (4 lines up).
|-
|<tt>38a7c9279cadeb44 9dca1d79d4dec6d5</tt>
|
|<tt>asdfghjkl</tt>
|No hint, but the same as the one below.
|-
|<tt>38a7c9279cadeb44 9dca1d79d4dec6d5</tt>
|he did the mash, he did the
|<tt>asdfghjkl</tt>
|Probably a "keyboard mash" (e.g. asdfghjkl), a common password. The hint is a reference to the song "{{w|Monster Mash}}" ("He did the mash/He did the monster mash").
|
|-
|<tt>38a7c9279cadeb44</tt>
|purloined
|<tt>asdfghjk</tt>
|A reference to the Edgar Allen Poe story "{{w|The Purloined Letter}}", this represents all the keys of the home row, or the keyboard mash password, but with one missing("purloined") letter.
|-
|<tt>a8ae5745a2b7af7a 9dca1d79d4dec6d5</tt>
|fav [http://bulbapedia.bulbagarden.net/wiki/Water_3_%28Egg_Group%29 water-3] {{w|List_of_Pokémon|Pokemon}}
|<tt>[http://bulbapedia.bulbagarden.net/wiki/Tentacool_(Pok%C3%A9mon) Tentacool]</tt>
|This is the only [http://bulbapedia.bulbagarden.net/wiki/Water_3_%28Egg_Group%29 water-3] Pokémon with a 9 letter name ending in "l", so it must be this to fit with the password 'asdfghjkl'
|-
|}

==Transcript==
:Hackers recently leaked '''''153 million''''' Adobe user emails, encrypted passwords, and password hints.
:Adobe encrypted the passwords improperly, misusing block-mode 3DES. The result is something wonderful:

<pre>
User password Hint
------------- ----

4e18acc1ab27a2d6 weather vane sword
4e18acc1ab27a2d6
4e18acc1ab27a2d6 a0a2876eb1ea1fca name1
8babb6299e06eb6d duh
8babb6299e06eb6d a0a2876eb1ea1fca
8babb6299e06eb6d 85e9da81a8a78adc 57
4e18acc1ab27a2d6 favorite of 12 apostles
1ab29ae86da6e5ca 7a2d6a0a2876eb1e with your own hand you
have done all this
a1f9b2b6299e7a2b eadec1e6ab797397 sexy earlobes
a1f9b2b6299e7a2b 617ab0277727ad85 best tos episode
39738b7adb0b8af7 617ab0277727ad85 sugarland
1ab29ae86da6e5ca name + jersey#
877ab7889d3862b1 alpha
877ab7889d3862b1
877ab7889d3862b1
877ab7889d3862b1 obvious
877ab7889d3862b1 Michael Jackson
38a7c9279cadeb44 9dca1d79d4dec6d5
38a7c9279cadeb44 9dca1d79d4dec6d5 he did the mash, he did the
38a7c9279cadeb44 purloined
a8ae5745a2b7af7a 9dca1d79d4dec6d5 fav water-3 pokemon
</pre>

:The greatest crossword puzzle in the history of the world

{{comic discussion}}

[[Category:Comics with color]]
[[Category:Pokémon]]

1286: Encryptic

2013-11-14T21:56:59Z

108.162.219.29: /* Passwords */

{{comic
| number = 1286
| date = November 4, 2013
| title = Encryptic
| image = encryptic.png
| titletext = It was bound to happen eventually. This data theft will enable almost limitless [xkcd.com/792]-style password reuse attacks in the coming weeks. There's only one group that comes out of this looking smart: Everyone who pirated Photoshop.
}}

==Explanation==
Web sites and other computers that authenticate users via passwords need to be able to know if the user typed in the right password. But storing the password itself on the computer has been known to be unnecessarily risky since the publication of [http://www.neurosecurity.com/articles/security/passwd.pdf Password Security: A Case History] in 1978. In that paper, Robert Morris and Ken Thompson demonstrated the practice of using a slow, cryptographically-secure one-way {{w|Hash function|hash function}}, so that even if the password file is stolen, it will be very hard to figure out what the passwords are, so long as the passwords themselves are suitably complex. They also pioneered the use of {{w|Salt (cryptography)|a “salt”}} which makes each password hash completely different even if two users use the same password. See [http://security.blogoverflow.com/2011/07/a-tour-of-password-questions-and-answers/ A tour of password questions and answers] for background on salts and suitably slow hash functions.

Adobe, however, ignored these well-known principles, and instead stored over a hundred million passwords in a reversably encrypted way, using a terrible choice of encryption methods which exposes a great deal of information about the passwords, and does not involve a salt. This password database was recently obtained by someone and released on the Internet.

In particular, Adobe used {{w|Triple DES}}, an older encryption algorithm which can still be relatively secure when properly used but they used it improperly. It works on 64-bit (8 character) blocks. Assuming that the passwords are stored in plain ASCII, this means that a sequence of 8 characters in a password which starts on a character position which is a multiple of eight is always encrypted to the same result. Therefore two passwords starting with “12345678” would start with the same block after being encrypted. Furthermore, this means that you can actually get a very good idea of the length of the password since anything with only one block is a password with length between 1 and 8 characters, and having two blocks implies it has between 9 and 16 characters, etc.

Adobe also stored hints users created for their passwords. That means that an attacker knows not only if the same 8 characters are used for multiple passwords but also has some hints for guessing them. That means that common password portions should be easy to recover and that any user may be “compromised” by someone else using a part of the same password and providing a good hint. As an example, a password having three hints “Big Apple”, “Twin Towers” and “If you can make it there” is probably “New York” (or a simple variation on that). The weakness here is that no decryption and therefore no hard cracking has to take place, you just group the passwords by their encrypted blocks and try to solve them like a crossword puzzle. These weaknesses have already been used to presumably identify a password used by {{w|Edward Snowden}}, as discussed at [http://7habitsofhighlyeffectivehackers.blogspot.com/2013/11/can-someone-be-targeted-using-adobe.html 7 Habits of Highly Effective Hackers: Can someone be targeted using the Adobe breach?].

The examples are not taken from the actual leaked file, since that [http://arstechnica.com/security/2013/11/how-an-epic-blunder-by-adobe-could-strengthen-hand-of-password-crackers/ uses a different format], and the examples are evidently cleverly crafted to make a nice crossword-like puzzle, which can be solved as shown in the Passwords section below.

As mentioned on http://filosottile.github.io/analyzing-the-adobe-leaked-passwords/ the data in the comic isn't real and contains a hidden message.
If the "user password" hashes are Base64 encoded, they read:
<pre>ThiswasnotagooduseofyourtimeButthenagainitwasprobablynotagooduseofmytimeeith
erAndyethereweareXOXOXOLetsLiveHereInThisTinySecretEncodedTextWorldForever==</pre>

E.g., with the initial unique hash blocks: <tt>python -c "print '4e18acc1ab27a2d6a0a2876eb1ea1fca'.decode('hex_codec').encode('base64')"</tt>

The last letter "r" is not fully encoded in the data shown, but any letter from "g" to "v" produces the same binary data.

The title text makes a reference to a previous comic: [[792|Black Hat’s trouble with what to do with stolen passwords]]. It also states that users of pirated Photoshop are the winners here. This is because in order to make Photoshop pirate-able, it was modified (cracked) by removing the requirement for registration so their passwords were not sent to Adobe and therefore are not present in the leaked file.

The title itself is a reference to [http://en.wikipedia.org/wiki/Cryptic_crossword cryptic crosswords]

==Passwords==
Note that characters in the passwords could be upper or lower case, and they may involve common substitutions like "0" (number zero) for "O" (letter O); therefore, the clues cannot guarantee that the answer shown here is precisely correct. Nevertheless, we have plenty of information for a brute force attack.

{|class="wikitable"
! Input
! Hint
! Password
! Explanation
|-
|<tt>4e18acc1ab27a2d6</tt>
|weather vane sword
|<tt>[http://redwall.wikia.com/wiki/Matthias matthias]</tt>
|In ''{{w|Redwall}}'', several characters are associated with a sword hung from a weather vane, but only Matthias shares the name of an apostle (6 lines down).
|-
|<tt>4e18acc1ab27a2d6</tt>
|
|<tt>matthias</tt>
|Although no hint was used, we know this password too, since it matches the previous one.
|-
|<tt>4e18acc1ab27a2d6 a0a2876eb1ea1fca</tt>
|name1
|<tt>matthias1</tt>
|Even without knowing the user's name, we already know how this starts, so the clue gives us a pretty good idea how it finishes (and another block useful 2 lines down)
|-
|<tt>8babb6299e06eb6d</tt>
|duh
|<tt>password</tt>
|Unfortunately, this is all too common, and the user practically told us that it's an easy one.
|-
|<tt>8babb6299e06eb6d a0a2876eb1ea1fca</tt>
|
|<tt>password1</tt>
|Although no hint was used, we know this by combining the previous two.
|-
|<tt>8babb6299e06eb6d 85e9da81a8a78adc</tt>
|57
|<tt>password57</tt>
|Since we know how this begins, this is a good guess.
|-
|<tt>4e18acc1ab27a2d6</tt>
|favorite of {{w|Apostle_(Christian)|12 apostles}}
|<tt>{{w|Saint_Matthias|matthias}}</tt>
|This has only 12 possibilities to begin with (plus variant spellings, variant lists, and one replacement), but actually we know already which one by combining with the clue 6 lines up. (Surprise: it's the replacement!)
|-
|<tt>1ab29ae86da6e5ca 7a2d6a0a2876eb1e</tt>
|with your own hand you have done all this
|<tt>Judith1510</tt>
|This is a quotation from [http://www.biblestudytools.com/nrsa/judith/15-10.html Judith 15:10] in the Bible.
|-
|<tt>a1f9b2b6299e7a2b eadec1e6ab797397</tt>
|sexy earlobes
|<tt>{{w|Charlie_Sheen|Charlie Sheen}}</tt>
|This refers to an episode of ''{{w|Two and a Half Men}}''. Other answers are possible, but only this one fits the next line.
|-
|<tt>a1f9b2b6299e7a2b 617ab0277727ad85</tt>
|best TOS episode
|<tt>{{w|Charlie_X|Charlie X}}</tt>
|"{{w|Star_Trek:_The_Original_Series|TOS}}" refers to the original series of ''{{w|Star Trek}}''. Although this had dozens of episodes, only one fits the previous line as well as the next line.
|-
|<tt>39738b7adb0b8af7 617ab0277727ad85</tt>
|Sugarland
|<tt>HoustonTX</tt>
|{{w|Sugar_Land,_Texas|Sugarland}} is a suburb of {{w|Houston}}, {{w|Texas}}. This fits with the previous line.
|-
|<tt>1ab29ae86da6e5ca</tt>
|name + jersey#
|<tt>Judith15</tt>
|Even if we knew this user's name, we wouldn't know their jersey number. But the clue 4 lines up already gave us the answer.
|-
|<tt>877ab7889d3862b1</tt>
|alpha
|<tt>abc</tt>
|This password is also far too common, but this clue still isn't enough to narrow it down. Combine with the clue 4 lines below, however, and it's quite easy.
|-
|<tt>877ab7889d3862b1</tt>
|
|<tt>abc</tt>
|No hint, but the same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|
|<tt>abc</tt>
|No hint, but the same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|obvious
|<tt>abc</tt>
|Same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|Michael Jackson
|<tt>abc</tt>
|{{w|Michael Jackson}} did many songs, but only one was {{w|ABC_(song)|alphabetical}} (4 lines up).
|-
|<tt>38a7c9279cadeb44 9dca1d79d4dec6d5</tt>
|
|<tt>asdfghjkl</tt>
|No hint, but the same as the one below.
|-
|<tt>38a7c9279cadeb44 9dca1d79d4dec6d5</tt>
|he did the mash, he did the
|<tt>asdfghjkl</tt>
|Probably a "keyboard mash" (e.g. asdfghjkl), a common password. The hint is a reference to the song "{{w|Monster Mash}}" ("He did the mash/He did the monster mash").
|
|-
|<tt>38a7c9279cadeb44</tt>
|purloined
|<tt>asdfghjk</tt>
|A reference to the Edgar Allen Poe story "{{w|The Purloined Letter}}", this represents all the keys of the home row, or the keyboard mash password, but with one missing("purloined") letter.
|-
|<tt>a8ae5745a2b7af7a 9dca1d79d4dec6d5</tt>
|fav [http://bulbapedia.bulbagarden.net/wiki/Water_3_%28Egg_Group%29 water-3] {{w|List_of_Pokémon|Pokemon}}
|<tt>[http://bulbapedia.bulbagarden.net/wiki/Tentacool_(Pok%C3%A9mon) Tentacool]</tt>
|This is the only water-3 Pokemon with a 9 letter name ending in "l", so it must be this to fit with the password 'asdfghjkl'
|-
|}

==Transcript==
:Hackers recently leaked '''''153 million''''' Adobe user emails, encrypted passwords, and password hints.
:Adobe encrypted the passwords improperly, misusing block-mode 3DES. The result is something wonderful:

<pre>
User password Hint
------------- ----

4e18acc1ab27a2d6 weather vane sword
4e18acc1ab27a2d6
4e18acc1ab27a2d6 a0a2876eb1ea1fca name1
8babb6299e06eb6d duh
8babb6299e06eb6d a0a2876eb1ea1fca
8babb6299e06eb6d 85e9da81a8a78adc 57
4e18acc1ab27a2d6 favorite of 12 apostles
1ab29ae86da6e5ca 7a2d6a0a2876eb1e with your own hand you
have done all this
a1f9b2b6299e7a2b eadec1e6ab797397 sexy earlobes
a1f9b2b6299e7a2b 617ab0277727ad85 best tos episode
39738b7adb0b8af7 617ab0277727ad85 sugarland
1ab29ae86da6e5ca name + jersey#
877ab7889d3862b1 alpha
877ab7889d3862b1
877ab7889d3862b1
877ab7889d3862b1 obvious
877ab7889d3862b1 Michael Jackson
38a7c9279cadeb44 9dca1d79d4dec6d5
38a7c9279cadeb44 9dca1d79d4dec6d5 he did the mash, he did the
38a7c9279cadeb44 purloined
a8ae5745a2b7af7a 9dca1d79d4dec6d5 fav water-3 pokemon
</pre>

:The greatest crossword puzzle in the history of the world

{{comic discussion}}

[[Category:Comics with color]]
[[Category:Pokémon]]

1286: Encryptic

2013-11-14T21:55:29Z

108.162.219.29: /* Passwords */

{{comic
| number = 1286
| date = November 4, 2013
| title = Encryptic
| image = encryptic.png
| titletext = It was bound to happen eventually. This data theft will enable almost limitless [xkcd.com/792]-style password reuse attacks in the coming weeks. There's only one group that comes out of this looking smart: Everyone who pirated Photoshop.
}}

==Explanation==
Web sites and other computers that authenticate users via passwords need to be able to know if the user typed in the right password. But storing the password itself on the computer has been known to be unnecessarily risky since the publication of [http://www.neurosecurity.com/articles/security/passwd.pdf Password Security: A Case History] in 1978. In that paper, Robert Morris and Ken Thompson demonstrated the practice of using a slow, cryptographically-secure one-way {{w|Hash function|hash function}}, so that even if the password file is stolen, it will be very hard to figure out what the passwords are, so long as the passwords themselves are suitably complex. They also pioneered the use of {{w|Salt (cryptography)|a “salt”}} which makes each password hash completely different even if two users use the same password. See [http://security.blogoverflow.com/2011/07/a-tour-of-password-questions-and-answers/ A tour of password questions and answers] for background on salts and suitably slow hash functions.

Adobe, however, ignored these well-known principles, and instead stored over a hundred million passwords in a reversably encrypted way, using a terrible choice of encryption methods which exposes a great deal of information about the passwords, and does not involve a salt. This password database was recently obtained by someone and released on the Internet.

In particular, Adobe used {{w|Triple DES}}, an older encryption algorithm which can still be relatively secure when properly used but they used it improperly. It works on 64-bit (8 character) blocks. Assuming that the passwords are stored in plain ASCII, this means that a sequence of 8 characters in a password which starts on a character position which is a multiple of eight is always encrypted to the same result. Therefore two passwords starting with “12345678” would start with the same block after being encrypted. Furthermore, this means that you can actually get a very good idea of the length of the password since anything with only one block is a password with length between 1 and 8 characters, and having two blocks implies it has between 9 and 16 characters, etc.

Adobe also stored hints users created for their passwords. That means that an attacker knows not only if the same 8 characters are used for multiple passwords but also has some hints for guessing them. That means that common password portions should be easy to recover and that any user may be “compromised” by someone else using a part of the same password and providing a good hint. As an example, a password having three hints “Big Apple”, “Twin Towers” and “If you can make it there” is probably “New York” (or a simple variation on that). The weakness here is that no decryption and therefore no hard cracking has to take place, you just group the passwords by their encrypted blocks and try to solve them like a crossword puzzle. These weaknesses have already been used to presumably identify a password used by {{w|Edward Snowden}}, as discussed at [http://7habitsofhighlyeffectivehackers.blogspot.com/2013/11/can-someone-be-targeted-using-adobe.html 7 Habits of Highly Effective Hackers: Can someone be targeted using the Adobe breach?].

The examples are not taken from the actual leaked file, since that [http://arstechnica.com/security/2013/11/how-an-epic-blunder-by-adobe-could-strengthen-hand-of-password-crackers/ uses a different format], and the examples are evidently cleverly crafted to make a nice crossword-like puzzle, which can be solved as shown in the Passwords section below.

As mentioned on http://filosottile.github.io/analyzing-the-adobe-leaked-passwords/ the data in the comic isn't real and contains a hidden message.
If the "user password" hashes are Base64 encoded, they read:
<pre>ThiswasnotagooduseofyourtimeButthenagainitwasprobablynotagooduseofmytimeeith
erAndyethereweareXOXOXOLetsLiveHereInThisTinySecretEncodedTextWorldForever==</pre>

E.g., with the initial unique hash blocks: <tt>python -c "print '4e18acc1ab27a2d6a0a2876eb1ea1fca'.decode('hex_codec').encode('base64')"</tt>

The last letter "r" is not fully encoded in the data shown, but any letter from "g" to "v" produces the same binary data.

The title text makes a reference to a previous comic: [[792|Black Hat’s trouble with what to do with stolen passwords]]. It also states that users of pirated Photoshop are the winners here. This is because in order to make Photoshop pirate-able, it was modified (cracked) by removing the requirement for registration so their passwords were not sent to Adobe and therefore are not present in the leaked file.

The title itself is a reference to [http://en.wikipedia.org/wiki/Cryptic_crossword cryptic crosswords]

==Passwords==
Note that characters in the passwords could be upper or lower case, and they may involve common substitutions like "0" (number zero) for "O" (letter O); therefore, the clues cannot guarantee that the answer shown here is precisely correct. Nevertheless, we have plenty of information for a brute force attack.

{|class="wikitable"
! Input
! Hint
! Password
! Explanation
|-
|<tt>4e18acc1ab27a2d6</tt>
|weather vane sword
|<tt>[http://redwall.wikia.com/wiki/Matthias matthias]</tt>
|In ''{{w|Redwall}}'', several characters are associated with a sword hung from a weather vane, but only Matthias shares the name of an apostle (6 lines down).
|-
|<tt>4e18acc1ab27a2d6</tt>
|
|<tt>matthias</tt>
|Although no hint was used, we know this password too, since it matches the previous one.
|-
|<tt>4e18acc1ab27a2d6 a0a2876eb1ea1fca</tt>
|name1
|<tt>matthias1</tt>
|Even without knowing the user's name, we already know how this starts, so the clue gives us a pretty good idea how it finishes (and another block useful 2 lines down)
|-
|<tt>8babb6299e06eb6d</tt>
|duh
|<tt>password</tt>
|Unfortunately, this is all too common, and the user practically told us that it's an easy one.
|-
|<tt>8babb6299e06eb6d a0a2876eb1ea1fca</tt>
|
|<tt>password1</tt>
|Although no hint was used, we know this by combining the previous two.
|-
|<tt>8babb6299e06eb6d 85e9da81a8a78adc</tt>
|57
|<tt>password57</tt>
|Since we know how this begins, this is a good guess.
|-
|<tt>4e18acc1ab27a2d6</tt>
|favorite of {{w|Apostle_(Christian)|12 apostles}}
|<tt>{{w|Saint_Matthias|matthias}}</tt>
|This has only 12 possibilities to begin with (plus variant spellings, variant lists, and one replacement), but actually we know already which one by combining with the clue 6 lines up. (Surprise: it's the replacement!)
|-
|<tt>1ab29ae86da6e5ca 7a2d6a0a2876eb1e</tt>
|with your own hand you have done all this
|<tt>Judith1510</tt>
|This is a quotation from [http://www.biblestudytools.com/nrsa/judith/15-10.html Judith 15:10] in the Bible.
|-
|<tt>a1f9b2b6299e7a2b eadec1e6ab797397</tt>
|sexy earlobes
|<tt>{{w|Charlie_Sheen|Charlie Sheen}}</tt>
|This refers to an episode of ''{{w|Two and a Half Men}}''. Other answers are possible, but only this one fits the next line.
|-
|<tt>a1f9b2b6299e7a2b 617ab0277727ad85</tt>
|best TOS episode
|<tt>{{w|Charlie_X|Charlie X}}</tt>
|"{{w|Star_Trek:_The_Original_Series|TOS}}" refers to the original series of ''{{w|Star Trek}}''. Although this had dozens of episodes, only one fits the previous line as well as the next line.
|-
|<tt>39738b7adb0b8af7 617ab0277727ad85</tt>
|Sugarland
|<tt>HoustonTX</tt>
|{{w|Sugar_Land,_Texas|Sugarland}} is a suburb of {{w|Houston}}, {{w|Texas}}. This fits with the previous line.
|-
|<tt>1ab29ae86da6e5ca</tt>
|name + jersey#
|<tt>Judith15</tt>
|Even if we knew this user's name, we wouldn't know their jersey number. But the clue 4 lines up already gave us the answer.
|-
|<tt>877ab7889d3862b1</tt>
|alpha
|<tt>abc</tt>
|This password is also far too common, but this clue still isn't enough to narrow it down. Combine with the clue 4 lines below, however, and it's quite easy.
|-
|<tt>877ab7889d3862b1</tt>
|
|<tt>abc</tt>
|No hint, but the same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|
|<tt>abc</tt>
|No hint, but the same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|obvious
|<tt>abc</tt>
|Same as the surrounding passwords.
|-
|<tt>877ab7889d3862b1</tt>
|Michael Jackson
|<tt>abc</tt>
|{{w|Michael Jackson}} did many songs, but only one was {{w|ABC_(song)|alphabetical}} (4 lines up).
|-
|<tt>38a7c9279cadeb44 9dca1d79d4dec6d5</tt>
|
|<tt>asdfghjkl</tt>
|No hint, but the same as the one below.
|-
|<tt>38a7c9279cadeb44 9dca1d79d4dec6d5</tt>
|he did the mash, he did the
|<tt>asdfghjkl</tt>
|Probably a "keyboard mash" (e.g. asdfghjkl), a common password. The hint is a reference to the song "{{w|Monster Mash}}" ("He did the mash/He did the monster mash").
|
|-
|<tt>38a7c9279cadeb44</tt>
|purloined
|<tt>asdfghjk</tt>
|A reference to the Edgar Allen Poe story "{{w|The Purloined Letter}}", this represents all the keys of the home row, or the keyboard mash password, but with one missing("purloined") letter.
|-
|<tt>a8ae5745a2b7af7a 9dca1d79d4dec6d5</tt>
|fav water-3 {{w|List_of_Pokémon|Pokemon}}
|<tt>[http://bulbapedia.bulbagarden.net/wiki/Tentacool_(Pok%C3%A9mon) Tentacool]</tt>
|This is the only water-3 Pokemon with a 9 letter name ending in "l", so it must be this to fit with the password 'asdfghjkl'
|-
|}

==Transcript==
:Hackers recently leaked '''''153 million''''' Adobe user emails, encrypted passwords, and password hints.
:Adobe encrypted the passwords improperly, misusing block-mode 3DES. The result is something wonderful:

<pre>
User password Hint
------------- ----

4e18acc1ab27a2d6 weather vane sword
4e18acc1ab27a2d6
4e18acc1ab27a2d6 a0a2876eb1ea1fca name1
8babb6299e06eb6d duh
8babb6299e06eb6d a0a2876eb1ea1fca
8babb6299e06eb6d 85e9da81a8a78adc 57
4e18acc1ab27a2d6 favorite of 12 apostles
1ab29ae86da6e5ca 7a2d6a0a2876eb1e with your own hand you
have done all this
a1f9b2b6299e7a2b eadec1e6ab797397 sexy earlobes
a1f9b2b6299e7a2b 617ab0277727ad85 best tos episode
39738b7adb0b8af7 617ab0277727ad85 sugarland
1ab29ae86da6e5ca name + jersey#
877ab7889d3862b1 alpha
877ab7889d3862b1
877ab7889d3862b1
877ab7889d3862b1 obvious
877ab7889d3862b1 Michael Jackson
38a7c9279cadeb44 9dca1d79d4dec6d5
38a7c9279cadeb44 9dca1d79d4dec6d5 he did the mash, he did the
38a7c9279cadeb44 purloined
a8ae5745a2b7af7a 9dca1d79d4dec6d5 fav water-3 pokemon
</pre>

:The greatest crossword puzzle in the history of the world

{{comic discussion}}

[[Category:Comics with color]]
[[Category:Pokémon]]

Talk:1288: Substitutions

2013-11-08T13:57:37Z

108.162.219.29:

We need a web plugin that does this automatically, stat! [[Special:Contributions/141.101.99.216|141.101.99.216]] 11:36, 8 November 2013 (UTC)
::Lol, I was just thinking the same thing! I was only meaning to post that in the discussion but saw that nobody had done the explanation yet. There goes a good chunk of my day :/ [[User:Zyxuvius|Zyxuvius]] ([[User talk:Zyxuvius|talk]]) 11:55, 8 November 2013 (UTC)
:::: Came here just to say this. Please post links to the unofficial xkcd news substitution tool as soon as it becomes available :P -- [[Special:Contributions/173.245.51.223|173.245.51.223]] 13:41, 8 November 2013 (UTC)

::::It already exists for Firefox: https://addons.mozilla.org/en-US/firefox/addon/foxreplace/ This addon allows you to create substitution lists that will automatically be applied to web pages. -- [[Special:Contributions/173.245.51.210|173.245.51.210]] 13:39, 8 November 2013 (UTC)

::I threw this together this morning for Chrome: https://github.com/ChrisMagellan/Make-News-Funny/ Note that you need to enable developer mode in your Extensions settings.