Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

github.com

Post reply on HN
Print view View original

61–70 of 126 posts

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#61

Post by pork »

tptacek wrote: post #42
aparadja wrote: post #14

Earlier quoted context omitted.

Perhaps I should have written it as "unsalted MD5" instead of "plain MD5" to avoid confusion. Unsalted MD5, in my opinion, is horrible. MD5 plays it's part in the mess: it's quick to calculate, which means that anybody can churn out huge lookup databases. Missing salts make those databases universally usable.

The salt does not matter. Neither does the specific hash; you'd be just as boned using SHA256. All cryptographic hash functions are designed to be fast. The vulnerability is "not using a password hash construction", of which the best known are bcrypt and PBKDF2.

Hate to be pedantic, and I'm sure you already know this, but you do realize that PBKDF2 uses SHA in HMAC mode right? There's nothing inherently slow about that, it's the repeated iterations of hashing.

You could slap MD5 into PBKDF2 with a high iteration count and achieve comparable security. The problem is that devs often use a hash function a single time.

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#62

Post by tptacek »

pork wrote: post #61
tptacek wrote: post #42

Earlier quoted context omitted.

The salt does not matter. Neither does the specific hash; you'd be just as boned using SHA256. All cryptographic hash functions are designed to be fast. The vulnerability is "not using a password hash construction", of which the best known are bcrypt and PBKDF2.

Hate to be pedantic, and I'm sure you already know this, but you do realize that PBKDF2 uses SHA in HMAC mode right? There's nothing inherently slow about that, it's the repeated iterations of hashing. You could slap MD5 into PBKDF2 with a high iteration count and achieve comparable security. The problem is that devs often use a hash function a single time.

I'm drawing a line between "cryptographic hash functions" and "password hash constructions". One is a "function", the other a "construction".

Password hash constructions do more than simply run the hash function multiple times.

We are, obviously, saying much the same thing.

Again: the key point here is, don't DIY this part of your application.

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#63

Post by bitemyapp »

chimeracoder wrote: post #39
georgefox wrote: post #33

wordlist = response.split(/\s+/) Thank God I use spaces liberally in my passwords.

Unfortunately, the same sites that are naive enough to use MD5 for cryptographic hashing are also likely the same sites naive enough to use oversimplified regexes that fail to validate all possible inputs. (If I had a dollar for every time the 'emailaddress+foo@gmail.com' failed to validate....)

>(If I had a dollar for every time the 'emailaddress+foo@gmail.com' failed to validate....)

That's not always accidental.

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#64

Post by city41 »

Cushman wrote: post #22

Seriously? Who is still using md5? There are strong hashing libraries for like every language. Anyone reading this uses md5? Can we find these people and just let them know?

Your post feels rather optimistic to me. Not only do a lot of people still use md5, I'd argue a sizable number of sites still store passwords in plain text.

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#65

Post by burgerbrain »

bad_user wrote: post #48
rimantas wrote: post #43

Earlier quoted context omitted.

You ommited this: > MD5 is a really fast hash to compute, salting or not. Just spend some time thinking about this.

Yes MD5 is fast to compute and ... NO, in the example I've given it really does not matter much. As I said, it should be easy cracking those hashes right? Prove me wrong.

"Prove me wrong."

This is not how discussions in this topic work.

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#66

Post by burgerbrain »

storborg wrote: post #52

Whenever one of these posts comes up it seems like there's a lot of comments rushing to defend salted MD5 or SHA1. What's actually wrong with bcrypt that prevents people from using it? Is it not available on all platforms? Too computationally expensive?

When people rush in to defend salted MD5/etc, they aren't actually doing it because they objectively think it's ok. They're doing it because presumably at some point in the past they have done it or allowed it to be done, they're just defending themselves. Unfortunate, since this is meant to be constructive criticism.

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#67

Post by tedunangst »

TheEskimo wrote: post #50
themouth wrote: post #11

Earlier quoted context omitted.

"It usually does" isn't quite accurate here. Common or weak plaintexts might work, but for the vast majority of input you're SOL. Sure "nicetry" comes back, but "nicetry99" produces 0 results and for every "nicetry" there are an infinite number of "nicetry"+i hashes.

Ah, you are technically incorrect in saying there are an infinite number of "nicetry"+i hashes. There are an infinite number of "nicetry"+i passwords, but eventually there will be collisions as the hash set stays a constant size and the password set grows without bound. "Infinite" isn't a term to throw around too lightly.

There are 2^128 possible MD5 hashes. When it becomes impossible to increment a counter to a number, that's as good as infinite.

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#68

Post by sdkmvx »

gaving wrote: post #27

Obligatory http://codahale.com/how-to-safely-store-a-password/ link which taught me a ton.

I see that link referenced a lot and don't think that's a good thing. He's right, but he doesn't explain why we should use bcrypt (or any other adaptive password hashing function). Picking bcrypt without knowing why is just as bad as picking MD5 without knowing why.

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#69

Post by ohyes »

JoachimSchipper wrote: post #57
ohyes wrote: post #55

Earlier quoted context omitted.

except you shouldn't have 'the' salt, you should have 'a' salt for each user...

The parent to my post specified "all use the same salt".

Phishing the password from one user and recovering the salt shouldn't be useful in the first place. The parent example was only meant to show how difficult it is to recover a salt even with multiple examples of its use, not to give a real life example of password hash use. (Which was my point)

That said, I don't know how you would obtain a list of hashed passwords without also getting the associated list of salts (wouldn't they be in the same database?), so it is kind of a moot point. The different salts are intended to prevent against the ability to have a single rainbow table to crack every password in the database.

Instead, you need a table for each salt, which means that you basically have to brute force the entire database. This still doesn't really help if you are using something fast like MD5, as brute force solution will be possible with that algorithm. Which is why you want something reasonably slow.

Re: I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

#70

Post by brunnsbe »

storborg wrote: post #52

Whenever one of these posts comes up it seems like there's a lot of comments rushing to defend salted MD5 or SHA1. What's actually wrong with bcrypt that prevents people from using it? Is it not available on all platforms? Too computationally expensive?

I would use bcrypt but it's not available as a encryption option for the realms in Apache Tomcat. One possibility would be to write an own realm but it's not that easy. Plus additional work is needed to update existing hashes, currently I therefore use salted MD5-hashes.
Post reply on HN