Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

stacksmashing.net

Post reply on HN
Print view View original

81–90 of 90 posts

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#81

Post by corin_ »

bittermang wrote: post #43
parenthesis wrote: post #41

We should stop calling them pass words to users, seeing as the best passwords are the concatenation of several non-words.

I believe we made a misstep with the password. I learned a long time ago that how you frame something for the user changes how they will interact with it. A common example I refer to is a small textarea on a website, and some clients wanting to see that textarea larger to encourage their users to write more in the box, or witnessing a user stopping and editing their post to frame it inside of the available area witho…

Passphrase still implies using actual words, passcode on the other hand does not.

That said, for the most part people who chose weak passwords do so for ease of memory, not because they're so stupid that they think they are only allowed words.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#82

Post by gommm »

pjscott wrote: post #72
ams6110 wrote: post #71

Earlier quoted context omitted.

That's avoided by not allowing more than three consecutive characters from the old password to be in the new password. It gets really annoying, trust me.

That would mean that they're storing the passwords themselves, hopefully encrypted, rather than just a salted slow hash of them. That makes me nervous. Should it?

you could have a form asking for the previous password and the new password... It then checks the previous password against the salted hash and then has the information to compare changes between the old password and new password without having to store anything

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#83

Post by konad »

mthoms wrote: post #75
sathyabhat wrote: post #66

Earlier quoted context omitted.

Why ?

In Germany, linking to illegal material can be considered a crime itself, for example linking to pirated software/media. http://www.webtvwire.com/linking-law-expert-dr-stephan-ott-t... IANAL but I suspect the OP feels the same laws could be applied here.

No. Germany (and the UK) applied the American drafted European legislation that says it is illegal to distribute software that could be used to break into computers.

http://www.securityfocus.com/brief/567 http://www.schneier.com/blog/archives/2007/08/new_german_hac...

This has had a chilling effect already

for instance

http://en.wikipedia.org/wiki/Hydra_%28software%29

On September 2007, to comply with new German laws regarding distribution of hacking tools to the public, THC stopped making the program available.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#84

Post by gjm11 »

gommm wrote: post #82
pjscott wrote: post #72

Earlier quoted context omitted.

That would mean that they're storing the passwords themselves, hopefully encrypted, rather than just a salted slow hash of them. That makes me nervous. Should it?

you could have a form asking for the previous password and the new password... It then checks the previous password against the salted hash and then has the information to compare changes between the old password and new password without having to store anything

Then you[1] can just alternate between two sequences of passwords: password1, cleverme1, password2, cleverme2, ...

[1] Meaning: anyone who wishes to use the service but isn't willing to come up with an unending stream of genuinely different passwords for it.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#85

Post by gjm11 »

corin_ wrote: post #81
bittermang wrote: post #43

Earlier quoted context omitted.

I believe we made a misstep with the password. I learned a long time ago that how you frame something for the user changes how they will interact with it. A common example I refer to is a small textarea on a website, and some clients wanting to see that textarea larger to encourage their users to write more in the box, or witnessing a user stopping and editing their post to frame it inside of the available area witho…

Passphrase still implies using actual words, passcode on the other hand does not. That said, for the most part people who chose weak passwords do so for ease of memory, not because they're so stupid that they think they are only allowed words.

Using actual words isn't such a bad thing if what you want to optimize is password entropy at a given level of memorability for naive users.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#86

Post by wisty »

drusenko wrote: post #62
yafujifide wrote: post #33

Allow me to be the first one to argue that we should require that users use longer passwords. This is not much of a burden. Your password will last for a very long time, and it takes only a few minutes to memorize a long password. If computing power doubles every 2 years, then every two years we should bump up the required password length to match. If each character is randomly chosen from amongst 2^6=64 possibilitie…

> Bcrypt and scrypt look great, but not fundamentally any better than longer passwords. A technical-only solution is infinitely better than one where you try to change user behavior. You think memorizing a long password is easy because it's easy for you. Try telling that to someone who's 72 and just started using the Internet. The reality is that anything that reduces friction to adoption is almost always a positive…

A good long password - the first few words of your favorite catchphrase in lowercase with no punctuation. For example: "well thats the funniest thing". I'm not sure how strong it is, but it doesn't seem too bad.

Some UNIX geek once wrote a tutorial saying that good passwords have a random collection of uppercase, lowercase, and punctuation marks. It's too hard, so people just use "Pa$$worD".

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#87

Post by 16s »

nezza-_- wrote: post #78
16s wrote: post #69

Earlier quoted context omitted.

That depends on the number and type of CPUs available. I know better than to race my CPU against a GPU. I won't win. I'm just pointing out the fact that if you have a fast GPU (or a cluster of them as the article suggests), then the hashes should be much better than what is provided. With those hashes, any CPU based cracker can do them easily. The article says 1 to 6 character passwords. With 12 cores, I can enumerat…

In the article it's stated that the hashes are brute forced using the provided charset. I think you used a wordlist, which is a whole other thing.

I use brute force on 0 to 5 character attempts. I get smart at 6 or more characters. No need to use brains or GPU speed to crack 5 char passwords. Here are more weak hashes from his list:

DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 "" no_pass

0D824508182A1AA0EEF9A0B6EE52F8A32AF06F0A "GoOd!" brute_5

A94B95A7A4D432DE056B0030DA879AF841376069 "GPGPU" brute_5

BFE06C47BE2390ACA934AB6A128C141DCEB4072F "G0o|)" brute_5

My point still stands. These should have been better/stronger hashes. I did all of that in less than an hour on a CPU using full enumeration (aka brute force).

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#90

Post by sathyabhat »

konad wrote: post #83
mthoms wrote: post #75

Earlier quoted context omitted.

In Germany, linking to illegal material can be considered a crime itself, for example linking to pirated software/media. http://www.webtvwire.com/linking-law-expert-dr-stephan-ott-t... IANAL but I suspect the OP feels the same laws could be applied here.

No. Germany (and the UK) applied the American drafted European legislation that says it is illegal to distribute software that could be used to break into computers. http://www.securityfocus.com/brief/567 http://www.schneier.com/blog/archives/2007/08/new_german_hac... This has had a chilling effect already for instance http://en.wikipedia.org/wiki/Hydra_%28software%29 On September 2007, to comply with new German laws…

I see. I was not aware of this, thanks for the details.
Post reply on HN