Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I Dedicated 4 Years to Mastering Offline Password Cracking

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 66 posts

Re: Show HN: I Dedicated 4 Years to Mastering Offline Password Cracking

#41

Post by raphman »

Cpoll wrote: post #39
raphman wrote: post #33

Earlier quoted context omitted.

A few small things. You might call this nitpicking. And, as I wrote, I found the technical details generally accurate. > "Then there is also the fact that having a fully-fledged graphical desktop environment running in the background at all times is not quite optimal to say the least. 99 percent of the time when cracking passwords, you will be staring at a black terminal filled with white text, so using Windows, whic…

> I'd argue that the mathematical operations themselves are usually not that complicated. More importantly, the whole book seems to be about ways to derive the (probable) input of a hash function from the output. It is not literally impossible. I think you're not being pedantic enough here. "Probable" is doing some heavy lifting. And the phrasing is "derive the input," which I think is fair to say. The best you can d…

Fair point. I was initially thinking about rainbow tables. Taking a hash and looking up associated passwords in a table feels like deriving to me - but I'm not a native speaker so I might have a wrong feeling here.

(It is obvious that one cannot directly derive the exact input - but one can derive potential inputs and then use other means to find the exact one.)

Re: Show HN: I Dedicated 4 Years to Mastering Offline Password Cracking

#43

Post by Cpoll »

raphman wrote: post #41
Cpoll wrote: post #39

Earlier quoted context omitted.

> I'd argue that the mathematical operations themselves are usually not that complicated. More importantly, the whole book seems to be about ways to derive the (probable) input of a hash function from the output. It is not literally impossible. I think you're not being pedantic enough here. "Probable" is doing some heavy lifting. And the phrasing is "derive the input," which I think is fair to say. The best you can d…

Fair point. I was initially thinking about rainbow tables. Taking a hash and looking up associated passwords in a table feels like deriving to me - but I'm not a native speaker so I might have a wrong feeling here. (It is obvious that one cannot directly derive the exact input - but one can derive potential inputs and then use other means to find the exact one.)

To me, "deriving from x" means performing a mathematical function operating on input x. By my own definition, I suppose a rainbow table lookup is a derivation, but I wouldn't consider actually computing the table to be one. Hash-cracking is more like guess-and-check than mathematical decoding; the hash to be cracked is just a verifier and not an input, which is why I make the (admittedly pedantic) distinction.

Re: Show HN: I Dedicated 4 Years to Mastering Offline Password Cracking

#44

Post by nojvek »

raphman wrote: post #3

Thanks for sharing. This looks interesting. Impressive achievement. This book is currently not really relevant for me, so I just skimmed the samples on Amazon. I found the technical content to be reasonably accurate and interesting although sometimes a little bit verbose (e.g., the section about 'what is a password') or slightly imprecise. In general, I think this book might have benefited from a thorough copyediting…

In this day, I actually appreciate imperfect human written content.

Too much AI slop, perfect grammar but no substance out there.

This seems like a substance filled book.

Congrats on shipping a book.

Re: Show HN: I Dedicated 4 Years to Mastering Offline Password Cracking

#45

Post by chadbennett »

I just bought the book and look forward to reading it. I also started in cyber at 14.

These are the kinds of real-world constraints where you actually learn how tools like Hashcat work under pressure.

You are going to do big things in the industry!

Re: Show HN: I Dedicated 4 Years to Mastering Offline Password Cracking

#46

Post by ofrzeta »

raphman wrote: post #33
dugidugout wrote: post #14

Earlier quoted context omitted.

What did you find slightly imprecise?

A few small things. You might call this nitpicking. And, as I wrote, I found the technical details generally accurate. > "Then there is also the fact that having a fully-fledged graphical desktop environment running in the background at all times is not quite optimal to say the least. 99 percent of the time when cracking passwords, you will be staring at a black terminal filled with white text, so using Windows, whic…

> (I am generally taking it a little bit personally when the author directly addresses me and tells me what I am probably thinking or doing.)

I think it's a canonical way to generalize the audience as in "99 percent of the time when cracking passwords, one will be staring at a black terminal filled with white text" just as in the German "man". So with that in mind maybe you no longer have a reason to be offended :)

Re: Show HN: I Dedicated 4 Years to Mastering Offline Password Cracking

#47

Post by MattPalmer1086 »

eigenrick wrote: post #7

This is an amazing achievement for someone of any age, but to publish a book with this much research at 18 is phenomenal. I heartily congratulate you. I've hopped through the book and it seems carefully laid out and organized. I may come back at you with questions once I've read further. Cheers.

I'll add my congratulations too.

I work in info sec - I've always been interested in password cracking and hashcat specifically, but have never had the time to devote to really dig into it. I'll check it out.

Well done!

Re: Show HN: I Dedicated 4 Years to Mastering Offline Password Cracking

#48

Post by raphman »

arcfour wrote: post #37
jfarina wrote: post #27

Earlier quoted context omitted.

It's awkwardly phrased and doesn't really say what it intends to (though, the meaning is obvious after reading it a second or third time). As for it being imprecise, it doesn't talk about any specific software that has any compatibility issues. It dismisses the topic out of hand.

I do think we should keep in mind the age of the author, which still makes it a very impressive achievement! There being room for improvement is both acceptable and expected.

I absolutely agree. There were no other comments on this post when I wrote my comment. Thus, I wanted to encourage the author and provide some constructive feedback in case nobody else would reply.
Post reply on HN