You need an app for this?
I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
31–40 of 126 posts
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#32Tried it with a bunch of passwords that I know my friends use (yes, they treat me like tech support) and it failed miserably with all of them.
It did however get a password that I use regularly (though not anymore) which I though was pretty complex.
So, friends with "idiot" passwords 1. Their so called computer-expert mate (me) 0.
I'm not so smug anymore.
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#33 wordlist = response.split(/\s+/)
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#34Seriously? Who is still using md5? There are strong hashing libraries for like every language. Anyone reading this uses md5? Can we find these people and just let them know?
> Anyone reading this uses md5?
I use MD5 all the time, just not for security.
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#35The exact same thing could occur if another (unsalted) hash becomes as popular?
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#36Earlier quoted context omitted.
Perhaps I should have written it as "unsalted MD5" instead of "plain MD5" to avoid confusion. Unsalted MD5, in my opinion, is horrible. MD5 plays it's part in the mess: it's quick to calculate, which means that anybody can churn out huge lookup databases. Missing salts make those databases universally usable.
> huge lookup databases "Huge" being the key word here. Try searching for the md5sums of arbitrary 8-character alphanumeric passwords. You won't find many results. 62^8 is a big number.
You can download rainbow tables as torrents.
8-character alphanumeric are the ones that are being offered today, it's only going to go up as GPUs get better and HD space/bandwidth increases.
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#37Earlier quoted context omitted.
Think of (3) as saying without salting, with Google and the internet, the precomputed tables that are used for brute-force attacks are already out there and can be queried with a simple Ruby program.
Why ruby in particular?
Because this particular program is in ruby.
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#38Earlier quoted context omitted.
If using your own salt is all you do, you'd still be susceptible to easy statistical attacks once someone compromises your database. But, yes, they probably wouldn't be available on google.
If using MD5 is all you do, you'd still be susceptible to brute force attacks . MD5 is a really fast hash to compute, salting or not. The solution is to pick a better algorithm and learn how to use it securely. That probably won't happen unless all the ridiculous PHP 'security' tutorials are erased from the history of the internet and only correct methods are shown.
If using MD5 is all you do, you'd still be
susceptible to brute force attacks.
Otherwise, demonstrate to me how you can find the passwords that relate to these hashes (all of them use the same salt):
23C206503ABD36FCB575FC8F12791CF0
D82BDB4160F60B657D6F994B553D2E63
0DA0572E042F822F91772F14269548E6
CB8BF6C16029400885F9A68A17576FA7
7CE4F679810409CF1477CF142B481EF9
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#39wordlist = response.split(/\s+/) Thank God I use spaces liberally in my passwords.
Unfortunately, the same sites that are naive enough to use MD5 for cryptographic hashing are also likely the same sites naive enough to use oversimplified regexes that fail to validate all possible inputs.
(If I had a dollar for every time the 'emailaddress+foo@gmail.com' failed to validate....)
Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.
#40Earlier quoted context omitted.
Do you have a reference that you would consider "the minimum you should know?" And, perhaps, maybe one somewhat better than that one? TIA.
Yes: http://codahale.com/how-to-safely-store-a-password/ This is the answer to this question. You should bookmark it and share it with your peers when this question inevitably comes up on another thread.
OK, so this is still the definitive thinking. I think you've told us about this before. Thanks again.