I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
1–10 of 126 posts
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#2For those who don't want to read the source code, BozoCrack has a simple algorithm. It googles the MD5 hash and hopes the first result page contains the plaintext password. It usually does.
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#3A simple salt would fix the issue with it finding on google (unless your salt is incredibly common).
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#4A simple salt would fix the issue with it finding on google (unless your salt is incredibly common).
Yep. I find it fascinating why plain unsalted md5 hashes are as common as they are. Developers go through the trouble of hashing, but don't go the single necessary step further.
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#5A simple salt would fix the issue with it finding on google (unless your salt is incredibly common).
Yep. I find it fascinating why plain unsalted md5 hashes are as common as they are. Developers go through the trouble of hashing, but don't go the single necessary step further.
Salted md5 is still surely laughably weak in an age of GPU cracking?
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#6Earlier quoted context omitted.
Yep. I find it fascinating why plain unsalted md5 hashes are as common as they are. Developers go through the trouble of hashing, but don't go the single necessary step further.
Salted md5 is still surely laughably weak in an age of GPU cracking?
Sure. I guess there's not a whole lot of excuses to avoid bcrypt these days.
Bozo's idea was to show that unsalted MD5 is, for most passwords, as bad as no encryption at all. An attack doesn't get much easier than a lookup table.
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#7I don't think it's demonstrating anything other than:
1) many developers don't use salts / HMAC
2) MD5 is popular
3) hashed passwords end up on Google
Any hashing function would have the same issues, simply because a hashing function is a mathematical function, so for any X from the domain of definition, H(X) will always have the same value, on every call. Therefore, if a hashing method is popular enough and developers don't salt their hashes, then hashes for common passwords will inevitably end up on Google. However, if you salt your hash calls with your own key, the hashes produced will be different from everybody else's.
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#8I don't think it's demonstrating anything other than: 1) many developers don't use salts / HMAC 2) MD5 is popular 3) hashed passwords end up on Google From these 3 points I don't think it follows that MD5 is horrible. Any hashing function would have the same issues, simply because a hashing function is a mathematical function, so for any X from the domain of definition, H(X) will always have the same value, on every…
If using your own salt is all you do, you'd still be susceptible to easy statistical attacks once someone compromises your database. But, yes, they probably wouldn't be available on google.
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#9I dub this “shameware” and declare it awesome.
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#10I don't think it's demonstrating anything other than: 1) many developers don't use salts / HMAC 2) MD5 is popular 3) hashed passwords end up on Google From these 3 points I don't think it follows that MD5 is horrible. Any hashing function would have the same issues, simply because a hashing function is a mathematical function, so for any X from the domain of definition, H(X) will always have the same value, on every…
If using your own salt is all you do, you'd still be susceptible to easy statistical attacks once someone compromises your database. But, yes, they probably wouldn't be available on google.
If using MD5 is all you do, you'd still be susceptible to brute force attacks. MD5 is a really fast hash to compute, salting or not.
The solution is to pick a better algorithm and learn how to use it securely. That probably won't happen unless all the ridiculous PHP 'security' tutorials are erased from the history of the internet and only correct methods are shown.