How crackers ransack passwords like “qeadzcwrsfxv1331”
arstechnica.com
How crackers ransack passwords like “qeadzcwrsfxv1331”
1–10 of 123 posts
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#2The punchline:
> The list contained 16,449 passwords converted into hashes using the MD5 cryptographic hash function.
Edit: I'm removing all my snarky nitpicking. This is a good article. Yes, the MD5 case they present is a poor case, but it's really about demonstrating the tactics of attack selection, rather than teaching someone how to make crack-resistant password schemes.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#3Enjoyable read, but I question the bit near the end claiming that salts wouldn't help much against this kind of attack.
From my understanding, per-user salting does substantially slow down this kind of attack because it forces you to calculate a different hash for each user/plaintext combination rather than hashing a suspected plaintext once and comparing the hash against the whole list. What it doesn't slow down is the brute-force cracking of a single targeted hash.
Am I missing something there, or is the article wrong?
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#4Enjoyable read, but I question the bit near the end claiming that salts wouldn't help much against this kind of attack. From my understanding, per-user salting does substantially slow down this kind of attack because it forces you to calculate a different hash for each user/plaintext combination rather than hashing a suspected plaintext once and comparing the hash against the whole list. What it doesn't slow down is…
Where/how do you store the salts?
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#5The punchline: > The list contained 16,449 passwords converted into hashes using the MD5 cryptographic hash function. Edit: I'm removing all my snarky nitpicking. This is a good article. Yes, the MD5 case they present is a poor case, but it's really about demonstrating the tactics of attack selection, rather than teaching someone how to make crack-resistant password schemes.
> the MD5 case they present is a poor case
If guys using vanilla hardware get that kind of success in 1 hour with MD5, you only need to increase hardware and the time required to see it's still completely doable for other hash functions.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#6Enjoyable read, but I question the bit near the end claiming that salts wouldn't help much against this kind of attack. From my understanding, per-user salting does substantially slow down this kind of attack because it forces you to calculate a different hash for each user/plaintext combination rather than hashing a suspected plaintext once and comparing the hash against the whole list. What it doesn't slow down is…
Where/how do you store the salts?
Right next to the hashed passwords. The point of salting isn't to add an additional level of secrecy, it's just to prevent the reuse of hashing work for attacking other users.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#7'Taekwondo1983' Was the password a fellow admin of an old forum I used to run. Wander if it was still him.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#8Earlier quoted context omitted.
Where/how do you store the salts?
Right next to the hashed passwords. The point of salting isn't to add an additional level of secrecy, it's just to prevent the reuse of hashing work for attacking other users.
But doesn't this render the process useless? If an attacker gets access to the hashes, he also gets access to the salts.
If both hashes and salts were isolated, I suppose it would be much more secure, although maybe too slow.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#9I think my favorite part of this is learning that after I finish with my bitcoin mining rig, I can use it to crack passwords. Awesome...
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#10Enjoyable read, but I question the bit near the end claiming that salts wouldn't help much against this kind of attack. From my understanding, per-user salting does substantially slow down this kind of attack because it forces you to calculate a different hash for each user/plaintext combination rather than hashing a suspected plaintext once and comparing the hash against the whole list. What it doesn't slow down is…
Where/how do you store the salts?
Right there in the same field as the password:
::
The pepper on the other hand shouldn't be in the db. Hardcode that into a config file.