Brute force attack on certitude

[+oblac]

Prosím, jak je zabezpečena aplikace Certitude proti násilnému prolomení? Jak je možné, že po publikaci keše  GCAJ1KY 10.01.2024 do dnes 25.02.2024 je zaznamenáno 11596 pokusů, které jsou téměř všechny od "jednoho?" hráče. V náhledu je hustá síť zásahů. Děkuji. Zdraví oblac

Edited February 25 by geoawareUSA9

[geoawareUSA9]

My bad translation:

 

7 hours ago, oblac said:

Please, how is the Certitude app secure against brute force? How is it possible that after the publication of the GCAJ1KY cache on 10/01/2024 to today 02/25/2024 there are 11596 attempts, almost all of which are from "one?" player. There is a dense network of hits in the preview.

 

Certitude is an API partner but not part of Groundspeak, so questions about their site would be best addressed by @certitude.

 

p.s. I edited your title, I imagine you'll get more resposes if the subject title is not your geocaching name.

Edited February 25 by geoawareUSA9

[+dadoskawina]

This makes less than 260 tries per day. I can imagine that one could make this even manually. Some automation is IMO possible but you are still limited to 10 tries / 10 minutes. So, taking into account that you can send up to 1440 tries/day and there is more that 10 millions possibilities, bruteforcing correct answer may take years. I don't think it is worth the effort.

 

PS. I see that since your post 8 hours ago, the counter did not change, so probably this person already gave up.

[+HHL]

This might be the appropriate forum to discuss API partner app's issues:

https://forums.geocaching.com/GC/index.php?/forum/140-authorized-developer-applications-api/

 

Hans

[+lee737]

On 2/25/2024 at 7:19 PM, oblac said:

Prosím, jak je zabezpečena aplikace Certitude proti násilnému prolomení? Jak je možné, že po publikaci keše  GCAJ1KY 10.01.2024 do dnes 25.02.2024 je zaznamenáno 11596 pokusů, které jsou téměř všechny od "jednoho?" hráče. V náhledu je hustá síť zásahů. Děkuji. Zdraví oblac

I gave the image my usual going over, nothing. Given how sparse the area is with caches, unless that hint really meant something I wouldn't bother brute forcing anything..... 

[+arisoft]

On 2/25/2024 at 7:00 PM, dadoskawina said:

Some automation is IMO possible but you are still limited to 10 tries / 10 minutes.

 

And after some sets of tries, you are limited to even less than 10/10, which makes carpet bombing more difficult.

Edited February 27 by arisoft

[+igator210]

I'm curious on the actually combination of numbers you'd need to brute force anything. And no I'm not advocating doing it.

All the math below could be totally wrong, if I've made a bad assumption along the way.

In a format of North AB CD.EFG West HI JK.LMN

And taking into consideration the two mile radius, can you always assume ABC and HIJ, leaving you only needing to brute force  the D.EFG and K.LMN portion?

 

There are 10 possibilities for each number, and this is where I'm not sure of the math. For the North you have 10 to the 4th power for a total of 10,000 combination. You'd also have this for the West. I'm just not sure how to come up with a total set of combination for North and West.

Regardless, even if you knew West and were trying to brute force just north, with only 10 tries per session, you'd need a max of 1000 sessions. At 10 minutes per session that is almost 7 days to run through all the combinations.  

Edited February 27 by igator210

[+arisoft]

In Finland (on the 60th Parallel) there are almost 13 million coordinates in 2 mail radius. It is too many for guessing anything. Usually you switch to brute force tactics when solving has succeeded only partially or somehow limited to very small area or small number of possible places. For example, if you have only 100 possible solutions, you may try to brute force all of these.

 

Last time I used brute force with Certitude, I had 73 different solutions and tried all of them. Second to last possible solution I tried was the correct one. Bad luck

 

Edited February 27 by arisoft

[+lee737]

16 minutes ago, arisoft said:

For example, if you have only 100 possible solutions, you may try to brute force all of these.

Right. At that stage it's doable. Before I start plugging away though, I'll use the toolbox incomplete coordinate tool to narrow down spots to start with. We had a partial solve of one in NZ recently, I think we were three digits short, but one was less significant, and the tool plus hint gave us some spots on the satellite to try - second guess, bingo! The deductions in this sort of brute force can be more fun than the puzzle itself....

[+Capt. Bob]

On 2/27/2024 at 11:05 AM, igator210 said:

 

There are 10 possibilities for each number, and this is where I'm not sure of the math. For the North you have 10 to the 4th power for a total of 10,000 combination. You'd also have this for the West. I'm just not sure how to come up with a total set of combination for North and West.

Regardless, even if you knew West and were trying to brute force just north, with only 10 tries per session, you'd need a max of 1000 sessions. At 10 minutes per session that is almost 7 days to run through all the combinations.  

 

4 factorial is 4! = 24  possible combinations
8 factorial is 8! = 40,320 possible combinations

Unfortunately, coordinates needed are 10 digits long NXX.XXX + WXX.XXX
10 factorial is 10! = 3,628,800  possible combinations

[+lee737]

10! would only apply if the digits weren't repeatable.....

There are a million combinations of the digits behind those decimal points - now mulitply that by whatever combinations of the minutes whole digits are applicable to the 3.2km radius of the puzzle.... this may be +/- 2-3 give or take, maybe 6 digit choices for latitude, 6 for longitude - that's c.36,000,000 by my maths..... could be wrong - I must admit my combinatorics can be way off!

[+arisoft]

4 hours ago, lee737 said:

that's c.36,000,000 by my maths..... could be wrong

 

It is less because a circle is smaller than a rectangle with the same height and width.

 

5 hours ago, Capt. Bob said:

4 factorial is 4! = 24  possible combinations

 

Ok, if you need to guess 4 digits to open a combination lock, you need only 24 tries at maximum. Right?

[+GeoTrekker26]

Combination lock is undefined.

[+lee737]

2 hours ago, arisoft said:

 

It is less because a circle is smaller than a rectangle with the same height and width.

 

 

Ok, if you need to guess 4 digits to open a combination lock, you need only 24 tries at maximum. Right?

Circle v rectangle - you're correct. I was in fact thinking this as I went to bed shortly after posting.....

Combination lock? They are generally 10 digits - so would be 10x10x10x10 combinations, not 4x3x2x1. On average you'd expect to need to try at least half before getting it right.....