Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hashcat 6.0

hashcat.net

Post reply on HN
Print view View original

31–40 of 55 posts

Re: Hashcat 6.0

#31

Post by jeroenhd »

Hamuko wrote: post #30
jeroenhd wrote: post #18

Earlier quoted context omitted.

What's the benefit of Metal in this use case? Are there any noticeable speedups in other brute forcing tools that switched to Apple's proprietary API? Given that OpenCL works on every decent modern platform and GPU brand I doubt much effort will be put into Metal unless someone familiar with the API and willing to put in the extra work joins the team of maintainers or creates a fork.

> What's the benefit of Metal in this use case? Continued usage on macOS if you care about that kind of a thing since Apple has deprecated OpenCL support.

TIL. That's awful, but then again I'd expect nothing less from Apple. It's a miracle they even supported open standards in the first place.

As long as Apple keeps OpenCL around, even if it's deprecated, these tools should still work. I'd expect that only the announcement of complete removal of OpenCL support would be enough to actually make hashcat put in the extra effort of writing a special Apple backend like that. Maybe they're generous or bored and do it before that, but I wouldn't expect them to in the near future.

Re: Hashcat 6.0

#32

Post by TecoAndJix »

Tenoke wrote: post #29
jrwr wrote: post #17

Earlier quoted context omitted.

Most hashes can be cracked with onlinehashcrack.com -- They are free if its under 8 characters and something like 5$ if its not. You can submit as many as you want and if they don't crack it. its free

Is there something similar for Ethereum presale wallet hashes? I have a wallet of which I know enough of the password to reduce the space to < 10 chars that need to be guessed.

Check out the configuration for a masked attack [0]. You could create a custom character set with the portion that you know and then brute the rest. You could then rent a p2.16xlarge [1] from AWS at about $15 per hour. If you know how much coin is in there you can do a cost/benefit analysis.

[0] https://hashcat.net/wiki/doku.php?id=mask_attack#custom_char... [1] https://aws.amazon.com/ec2/instance-types/p2/

Re: Hashcat 6.0

#33

Post by Tenoke »

TecoAndJix wrote: post #32
Tenoke wrote: post #29

Earlier quoted context omitted.

Is there something similar for Ethereum presale wallet hashes? I have a wallet of which I know enough of the password to reduce the space to < 10 chars that need to be guessed.

Check out the configuration for a masked attack [0]. You could create a custom character set with the portion that you know and then brute the rest. You could then rent a p2.16xlarge [1] from AWS at about $15 per hour. If you know how much coin is in there you can do a cost/benefit analysis. [0] https://hashcat.net/wiki/doku.php?id=mask_attack#custom_char... [1] https://aws.amazon.com/ec2/instance-types/p2/

Thanks! That looks fairly simple, I'll try to set it up on my machine first but even a p2 instance will be worth it in this case.

Re: Hashcat 6.0

#34

Post by derefr »

Cthulhu_ wrote: post #23
sam_goody wrote: post #11

That's ~5 commits a DAY on average since the last release a year ago, primarily from 29 contributors. That is a rate of development that bests most paid teams that I know of. I am very impressed. How do you manage so much commitment for an open source project?

Security researchers / developers are employed by companies and organizations that have an interest in this technology, e.g. law enforcement, secret services. I suspect most serious / active open source projects have a number of paid for developers like that. TBH, they need it, if their scale is beyond a small library / utility.

hashcat is also one of those tools that is both 1. a “core” that can be used in other software; while also being 2. in a class of software that benefits heavily from network effects (i.e. when someone contributes new algorithms to it, everyone gets just a little further in cracking the “mystery hashes” they have laying about.)

Hash reversing as a problem having property #2, virtually guarantees that the landscape of hash-reversing software would look like an oligopoly, because people would use the tools with the most algorithms, and so contribute to those, and so “the rich get richer.”

But hashcat having property #1 means that there’s no political reason (e.g. your enterprise wanting to ship something with your own branded GUI on it) to be unable to use hashcat, and so no reason for anyone to create their own new full-stack hash reversing system, when hashcat already exists to be used within such software.

Effectively, these properties are the same thing that made ffmpeg the “winner” in its own space, as discussed yesterday (https://news.ycombinator.com/item?id=23540704).

Re: Hashcat 6.0

#35

Post by continuational »

jeroenhd wrote: post #31
Hamuko wrote: post #30

Earlier quoted context omitted.

> What's the benefit of Metal in this use case? Continued usage on macOS if you care about that kind of a thing since Apple has deprecated OpenCL support.

TIL. That's awful, but then again I'd expect nothing less from Apple. It's a miracle they even supported open standards in the first place. As long as Apple keeps OpenCL around, even if it's deprecated, these tools should still work. I'd expect that only the announcement of complete removal of OpenCL support would be enough to actually make hashcat put in the extra effort of writing a special Apple backend like that.…

It's not such a miracle - all companies like standards until they have sufficiently many apps on their platform - then they switch to proprietary to prevent app portability to competing platforms.

Re: Hashcat 6.0

#36

Post by umvi »

So what's the difference between hashcat and johntheripper?

Any reason to use one over the other?

Re: Hashcat 6.0

#38

Post by tristor »

umvi wrote: post #36

So what's the difference between hashcat and johntheripper? Any reason to use one over the other?

Hashcat has massively better scalability and support for GPU acceleration

Re: Hashcat 6.0

#39

Post by SloopJon »

umvi wrote: post #36

So what's the difference between hashcat and johntheripper? Any reason to use one over the other?

I had to check to see whether John the Ripper is still maintained. As a matter of fact, 1.9.0 was released last year, four years after 1.8.0:

https://www.openwall.com/lists/announce/2019/05/14/1

The release notes mention that CUDA support was dropped, but that 88 formats out of 407 have OpenCL support.

A few formats also have support for the ZTEX 1.15y, a now-discontinued FPGA-based board popular for crypto mining, which is something I don't think Hashcat has. Here's an article I found on that topic:

https://medium.com/@ScatteredSecrets/bcrypt-password-crackin...

Edit: the two HN submissions for JtR 1.9.0 got no comments, but this Slashdot post does have some comments from a maintainer:

https://it.slashdot.org/story/19/05/18/1841245/new-john-the-...

Re: Hashcat 6.0

#40

Post by bredren »

Hamuko wrote: post #10

Is there a Hashcat-as-a-Service or is everyone just renting out EC2 GPU instances by the hour?

Forge by Inferno Systems wraps hashcat with a workflow more conducive to non-technical people. That currently requires on-site but I believe they have a cloud offering planned: https://inferno-systems.com/forge/index.html
Post reply on HN