Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
It's like a pink elephant, but a hash
Convert hashes to mnemonic phrases.
Hashes are great for many machine-specific purposes, but if you give a hash to a person (e.g., display it on a console), you're doing something wrong. Humans struggle with remembering, comparing, or typing hashes accurately. For most people, 8f776debaf8b5031643aa463ba5bf0dc
and 8f776debaf8b5013643aa463ba5bf0dc
look essentially the same.
However, humans aren’t entirely useless — they can remember vivid phrases quite well. If you tell someone not to think about a pink elephant (or a white monkey), and then Margot Robbie calls to ask them out on a date, even after spending the entire evening and night with her, they’ll still be thinking about the pink elephant.
If a hash is converted into words, people will remember it much better:
alter print drive
// bip39 with en
option by default, but we have fr
, es
, pt
, it
, ko
, cz
, zh-hant
and zh-hans
as wellWELL LANE HELD
// rfc1751configurational candidate
// eng1Uniform X-ray November
// natorecommended way (you may want to apt install pipx
for this):
pipx install pinkhash
or older way:
pip install pinkhash
# get pink hash for stdin, default mode with bip39/en
$ echo "Hello world!" | pink
hybrid interest chimney
# or in French...
$ echo "Hello world!" | pink -o fr
gazelle griffure caméra
# Nato alphabet, 5 words
$ echo "Hello world!" | pink -l nato -w 5
Charlie Zulu Tango Juliett Oscar
# eng1 always returns 2 words, no matter how many we ask
$ echo "Hello world!" | pink -l eng1 -w 42
chief clioquinol
How to get pinkhash for files:
# pink can hash many files
$ pink *txt
cookies.txt: pelican number item
DNS.txt: shadow expire inhale
log.txt: absurd now caution
Get pinkhash for a str
with all default settings (Bip39 language as default).
from pinkhash import PinkHash
pink = PinkHash()
print(pink.convert('Hello world!'))
from pinkhash import PinkHash
import sys
pink = PinkHash(language_name='nato', nwords=3)
data = sys.stdin.buffer.read()
r = pink.convert(data)
print(r)
Each method to convert hash into words in Pinkhash is called an language. For example, nato
is one language and rfc1751
is another language. Do not confuse this with a national language. Pinkhash now has built-in eng1
language (which produces adjective+noun pair from large set of english words) but in future there could be another english language, e.g. one which uses only simple popular words, or one which builds longer phrases or one which produces poems or haiku.
Usually (but not always) language can produce hashes of specified (-w
) number of words, but eng1
never produces more then 2 words. Also pinkhash will not produce more words then needed to cover only lower 64bits of sha1 hash of input.
BIP-39
language (based on BIP-0039) has 10 options (wordlists), choose it with -o
. See all options with -h
/--help
.
While pinkhash uses RFC1751
and BIP-0039
, it's not strictly following it! Pinkhash has it's own algorithms and just uses wordlists from these standards. Do not use pinkhash where you need strict standard compliance.
Mnemonical pink hashes are NOT cryptographically strong.
Contributions are welcome! Write me to yaroslaff / gmail.com to discuss or make a ticket and/or PR.
FAQs
Convert any hash/data into human-friendly memorable phrase (numerous ways)
We found that pinkhash demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.