Introduction to GPU Password Cracking: Owning the LinkedIn Password Dump
1–10 of 79 posts
Re: Introduction to GPU Password Cracking: Owning the LinkedIn Password Dump
#2Any developer today that is developing an application and isn't using something like Argon2, Bcrypt, or Scrypt should be considering a plan to move away from whatever they're currently using yesterday. There is no reason to be using anything less than those three and continued use is in my mind negligence.
If at all possible you shouldn't be storing passwords to begin with and instead relying on another service for authentication.
This should be the takeaway from this article.
Re: Introduction to GPU Password Cracking: Owning the LinkedIn Password Dump
#3Honest question, how does somebody know whether a dumped hashed/"encrypted" password has actually been broken and exists in plaintext?
Some time ago I reset almost all my passwords to 1passwd $RAND, but some of these dumps are ooooold. Is there a legit way to find what's available for my email?
Re: Introduction to GPU Password Cracking: Owning the LinkedIn Password Dump
#485% cracked in a few days is seriously depressing.
What does a box like the one mentioned in the article cost?
Any estimate on the time to crack the remaining 15%?
Re: Introduction to GPU Password Cracking: Owning the LinkedIn Password Dump
#5Honest question, how does somebody know whether a dumped hashed/"encrypted" password has actually been broken and exists in plaintext? Some time ago I reset almost all my passwords to 1passwd $RAND, but some of these dumps are ooooold. Is there a legit way to find what's available for my email?
There are some efforts, like https://haveibeenpwned.com/. However, personally? I always feel naked dishing out my email(s) in a ... Irregardless of HTTPS or HTTP.
Re: Introduction to GPU Password Cracking: Owning the LinkedIn Password Dump
#6Honest question, how does somebody know whether a dumped hashed/"encrypted" password has actually been broken and exists in plaintext? Some time ago I reset almost all my passwords to 1passwd $RAND, but some of these dumps are ooooold. Is there a legit way to find what's available for my email?
[deleted]
Re: Introduction to GPU Password Cracking: Owning the LinkedIn Password Dump
#7Honest question, how does somebody know whether a dumped hashed/"encrypted" password has actually been broken and exists in plaintext? Some time ago I reset almost all my passwords to 1passwd $RAND, but some of these dumps are ooooold. Is there a legit way to find what's available for my email?
There are several services (including one run by me).
https://canar.io (mine)
Mine lets you free-form search whereas HaveIBeenPwned is there for searching just e-mail addresses.
Re: Introduction to GPU Password Cracking: Owning the LinkedIn Password Dump
#8Yes, sure. You should not be using anything but Bcrypt et al for passwords (salt, salt, salt!) – but... Out of curiosity. What if these passwords were SHA-512 hashed (unsalted) rather than SHA1?
Anyone know of comparable articles?
Re: Introduction to GPU Password Cracking: Owning the LinkedIn Password Dump
#9Any developer today that is developing an application and isn't using something like Argon2, Bcrypt, or Scrypt should be considering a plan to move away from whatever they're currently using yesterday. There is no reason to be using anything less than those three and continued use is in my mind negligence. If at all possible you shouldn't be storing passwords to begin with and instead relying on another service for a…
Most of the attacks described in this article are not solved by any of those though right? They protect against hacking one person but if you just do these advanced dictionary attacks you can still crack people with weak passwords.
Maybe I'm missing something?
Re: Introduction to GPU Password Cracking: Owning the LinkedIn Password Dump
#10Any developer today that is developing an application and isn't using something like Argon2, Bcrypt, or Scrypt should be considering a plan to move away from whatever they're currently using yesterday. There is no reason to be using anything less than those three and continued use is in my mind negligence. If at all possible you shouldn't be storing passwords to begin with and instead relying on another service for a…
Most of the attacks described in this article are not solved by any of those though right? They protect against hacking one person but if you just do these advanced dictionary attacks you can still crack people with weak passwords. Maybe I'm missing something?
[deleted]