History Main / PasswordSlotMachine

* [[http://www.securityfriday.com/Topics/share_passwd.html A bug in Windows 95/98/Me]] allowed an attacker to discover passwords for shared folders and printers in a very Hollywoodian way. Not that it needs to guess all of the characters in the first place.

* Sally and her hand-held widget hack into something of Robotnik's this way in ''WesternAnimation/SonicSatAM''. A train and some acrobatics were involved in this scene as well.

* In the ''Series/DoctorWho'' episode "School Reunion", the ''code to take control of the universe'' is partly cracked like this. [[spoiler: Micky prevents this from happening... [[CutTheJuice by pulling out the plug]]]].

* Ash uses a gadget that does this to crack the four-digit security code to the employee entrance at a bank in the ''Series/{{Hustle}}'' episode "The Hush Heist".

* ''Series/{{CSINY}}'': Used by a pair of car thieves to crack the security code on a Ferrari in "Cavallino Rampante".
* ''Series/{{Leverage}}'': Hardison uses one of these to crack the ten-digit code on the electronic lock to the server room in "The Nigerian Job".

* ''Series/LawAndOrderCriminalIntent'': A burglar uses one to crack a hotel safe in "Folie à Deux".

* ''VideoGame/SplinterCellChaosTheory'' has electronic lock hacking essentially like this. Except the player has to [[http://uk.faqs.ign.com/articles/603/603704p1.html manually move the cursor over and secure the code fragments]], making it a blend of ''VideoGame/{{Uplink}}'' and ''VideoGame/{{Klax}}''.

This trope is a sort of ExactProgressBar, and it's usually used in time-critical situations. The "locking in" is a handy device to show the audience how close the computer is to cracking the password.

More ridiculous is when it cycles through dozens of numbers on the readout when it should, at most, only have to cycle through ten if each digit can be "locked in." If a password is ''n'' symbols long and there are ''m'' possibilities for each symbol, then the complexity of brute force is usually ''m''^''n'', but the password slot machine reduces it to ''m''*''n''.[[note]]This is similar to looking for a particular grain of sand in a small bottle (''m''*''n''), versus the same grain of sand on an entire beach (''m''^''n'').[[/note]] For example, a six digit password of only numbers takes up to 10^6 = 1,000,000 tries to brute force, but if correct digits "lock in" then it takes at most 10*6 = 60 tries instead (the best strategy would be to cycle through an ordered string e.g. 12345, then 23451, 34512, etc., which would cut guesses down to ''m'').

* Ash uses a gadget that does this to crack the four digit security code to the employee entrance at a bank in the ''Series/{{Hustle}}'' episode "The Hush Heist".

* ''Series/{{Leverage}}'': Hardison uses one of these to crack the ten digit code on the electronic lock to the server room in "The Nigerian Job".

* The old [=NES=] game ''Videogame/ClashAtDemonhead'' featured this after beating the final boss, where you had to crack the code for a [[DoomsdayDevice bomb that would destroy the world]]. You (the player) had a number of chances of guessing the code. Each correctly guessed digit locks, and you had to guess the remaining.

* The Nintendo Wii's code signing system which prevents unlicensed programs from running on a non-debug console had a bug similar to the last one. The "key" (sort of like a password) was checked until a "NULL" byte was reached. A hacking group found that ''Zelda'''s key had a NULL byte fairly early, so they could bruteforce out to the null byte and didn't have to figure out the rest of the key. This exploit (called the "strncmp bug" because of the way the Wii used strncmp instead of memcmp [memcmp doesn't stop at null bytes]) paved the way for dozens of others, and nowadays you can run anything on the Wii.

The way passwords get [[http://en.wikipedia.org/wiki/Brute_force_attack brute forced]] tends to make very little sense. What you normally see in a movie or TV show is all the possible codes flashing on the screen, and then the computer locks in correct digits ''one at a time''. It seems that computer password systems are similar to tumbler locks: You can pick it one at a time. But real passwords either work or don't. It's not a game of TabletopGame/{{Mastermind}}.

[[folder:Anime and Manga]]

[[folder:Film]]

* A giant binary version of this is used by ''WesternAnimation/ReBoot'''s Megabyte, twice. The first time he used it to hack into stolen files from Dot's organizer; files which happened to contain hundreds of binome [=PIDs.=] The second time he used it to extract a portal command from Phong's mind.

* [[http://www.securityfriday.com/Topics/share_passwd.html A bug in Windows 95/98/Me]] allowed an attacker to discover passwords for shared folders and printers in a very Hollywoodian way.
** Not that it needs to guess all of the characters in the first place.

* There exists a password script for personal home pages known as "[=HpbChkPwd=]", ostensibly from IBM Japan's [[http://www-06.ibm.com/software/jp/internet/hpb/ Home Page Builder]] software, which can be cracked via a Password Slot Machine. The client side can see an "encrypted string" and a [=JavaScript=] verification function. Analysis of the function shows that each character in the encrypted string is affected by only one character in the password, and also reveals some clues as to what the decrypted string should look like. Thus, cracking the password is a matter of locking in one character at a time in the password, and not even necessarily starting from the first or last character. By the way, if any would-be black-hat script kiddies are reading this, some crucial details have been left out a la Series/MythBusters.
** However, password-protecting webpages using Javascript alone is technically weak and can easily be subverted anyway.

[[quoteright:350:[[Film/ResidentEvil http://static.tvtropes.org/pmwiki/pub/images/passcode_search.jpg]]]]

[[quoteright:350:[[Film/ResidentEvil http://static.tvtropes.org/pmwiki/pub/images/passcode_search.jpg]]]]Look what I've found.

[[quoteright:160:[[ComicBook/LuckyLuke http://static.tvtropes.org/pmwiki/pub/images/LuckyLuke_-_DT_9263.JPG]]]]
[[caption-width-right:160: [-The UsefulNotes/GameBoyColor teaches us that [[AnachronismStew this trope was present back in the Wild Wild West]].-] ]]

[[folder:{{Anime}} and {{Manga}}]]

[[folder:{{Film}}]]

[[folder:LiveActionTV]]

[[folder:VideoGames]]

[[folder:WesternAnimation]]

[[folder:RealLife]]

[[caption-width-right:160: [-The GameBoyColor teaches us that [[AnachronismStew this trope was present back in the Wild Wild West]].-] ]]

** The old WEP encryption standard for wi-fi networks was SO bad that hackers could actually mount an attack that guessed the key bytes one after another, and "locked in" them when [[http://www.theregister.co.uk/2007/05/15/wep_crack_interview/ successive guesses polarized towards some value]]. Not that different from the way [[WarGames Joshua tried to break in the missile silos]]...

* After fixing a keypad's circuit board in ''Safecracker'', the keypad automatically displays the correct code like this.

* ''SplinterCell: Chaos Theory'' has electronic lock hacking essentially like this. Except the player has to [[http://uk.faqs.ign.com/articles/603/603704p1.html manually move the cursor over and secure the code fragments]], making it a blend of ''{{Uplink}}'' and ''Klax''.

A computer system is protected by a password. Unfortunately, unlike [[ThePasswordIsAlwaysSwordfish many other fictional scenarios]], the password isn't the easily guessable obsession of the character owning the computer, and is often just a random jumble of numbers and letters. So, the only solution is to [[http://en.wikipedia.org/wiki/Brute_force_attack brute force]] it. However, the way it gets brute forced tends to make very little sense.

What you normally see in a movie or TV show is all the possible codes flashing on the screen, and then the computer locks in correct digits ''one at a time''. It seems that computer password systems are similar to tumbler locks: You can pick it one at a time. But real passwords either work or don't. It's not a game of TabletopGame/{{Mastermind}}.

Another possible justification exists when the password is being guessed sequentially; say we have a password of 325 and we work it out by inputting every possible combination in order. The digits look like they are locked in but would be replaced if no match was found with the following numbers, so at first it would look like the first digit is locked in as 0, then 1 and then 2 before settling on 3.

** Averted in the episode ''Dalek''. When the titular Dalek begins its prison break, it is faced with a locked door with "over a million combinations". It cycles through all the combinations at high speed before realizing that the password is a series of asterisks, and though each new asterisk appears and stays in place, this happens in sequence, because by this point the Dalek has eliminated the actual numbers for that digit and so moves on to the next.

More ridiculous is when it cycles through dozens of numbers on the readout when it should, at most, only have to cycle through ten if each digit can be "locked in." If a password is ''n'' symbols long and there are ''m'' possibilities for each symbol, then the complexity of brute force is usually ''m''^''n'', but the password slot machine reduces it to ''m''*''n''.[[note]]This is similar to looking for a particular grain of sand in a small bottle (''m''*''n''), versus the same grain of sand on an entire beach (''m''^''n'').[[/note]] For example, a six digit password of only numbers takes up to 10^6 = 1,000,000 tries to brute force, but if correct digits "lock in" then it takes at most 10*6 = 60 tries instead (the best strategy would be to cycle through an ordered string e.g. 12345, then 23451, 34512, etc this would cut guesses down to ''m'').

There is a possible justification when the password is being guessed sequentially; say we have a password of 325 and we work it out by inputting every possible combination in order. The digits look like they are locked in but would be replaced if no match was found with the following numbers, so at first it would look like the first digit is locked in as 0, then 1 and then 2 before settling on 3.

* ''Franchise/TheMatrix'' both opens and closes with a scene of this, as the Agents lock in on the telephone number. Back in the pre-computer days, telephone routing systems really did use successive digits to determine routing (just as the first three digits still indicate the exchange, modulo number portability). However, this would have resulted in determining the digits from left to right, not randomly as shown in the movies.

* Played completely straight by the terrorists in ''{{Bloodfist}} VI'' to crack the nuclear launch codes.

Subtrope of HollywoodHacking.

* ''Manga/DetectiveConan'': Ran has Conan's phone, thinking he's Shinichi and her sent SMS being on it would prove the connection, and decides to crack the password. [[ThePasswordIsAlwaysSwordfish Birthdates]] aren't correct, so she decides to start with 0000 and proceeding one digit at a time. After a few hours of trying, she wonders if the password is "Holmes" in number-format and it turns out to be right.