I think my favorite part of this is learning that after I finish with my bitcoin mining rig, I can use it to crack passwords. Awesome...
If it's a specialised rig then it'll only be good for MD5 I think. Most sensible websites don't use MD5 anymore.
How crackers ransack passwords like “qeadzcwrsfxv1331”
41–50 of 123 posts
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#42Well the bonehead hashcat program is limited to 15 character passwords, so it can't possibly crack mine.
The hashcat program software in general is powerful, though pretty crappy from a design standpoint. The current version crashes if any input is not what it expects, and it has just about zero help for what it expects. Actually I can't even get it to work, as executing hashcat-lite.exe with arguments causes it to just immediately exit without doing anything nor printing any output.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#43Cue a test-how-strong-your-password-is service where security conscious individuals can test how their particular password stands up against these new attacks.
And have their password added to a word-list.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#44'Taekwondo1983' Was the password a fellow admin of an old forum I used to run. Wander if it was still him.
Probably not, 'Taekwondo1983' sound like a password some percentage of people who practice a certain sport and are born in a certain year would choose.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#45Earlier quoted context omitted.
Where/how do you store the salts?
Right there in the same field as the password: :: The pepper on the other hand shouldn't be in the db. Hardcode that into a config file.
"Pepper"s are essentially meaningless and provide no real benefit over a salt.
And you should be using bcrypt anyway.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#46I think my favorite part of this is learning that after I finish with my bitcoin mining rig, I can use it to crack passwords. Awesome...
If it's a specialised rig then it'll only be good for MD5 I think. Most sensible websites don't use MD5 anymore.
Most sensible websites don't use MD5 anymore
What makes you say that? Do you mean new sites or all site? Got anything to back it up?
I would guess most sites in existence use MD5, SHA1 or similar with 1 round, because it was (is?) very popular.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#47Earlier quoted context omitted.
The article clearly explained that using more salts was preferable to using a global salt and did a good job of explaining why. They didn't come out and say that a per-user salt is best, but that's the natural conclusion of the argument they developed.
Maybe we read different articles, but the one I read seemed intent on strongly downplaying the amount of extra security that salting provides. It actually uses the phrase "minimal amount of protection" to describe a salt's effect on cracking attempts. That seems like a strange choice of words when salting would've completely changed the outcome of the cracking attempts described in the article. Edit: To be clear, I'm…
Salting wouldn't have changed the outcome of the cracking attempts in the article. The primary focus was on how pre-computed hashes (rainbow tables, etc.) are no longer a tool used by most people attacking password lists because GPU-based hashers are efficient enough, the dicts long enough, and the methods of permuting the dicts (combinations, leet substitutions, markov chains, etc.) are rich enough that storing all possible hashes is actually less effective than writing an MD5 kernel for your AMD GPU and letting it go, monitoring for trends in the output.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#48Earlier quoted context omitted.
The issue is practicality. Which is why pbkdf2 (and increasing the rounds each year) + bcrypt or scrypt is still a better option.
Noob question, but why would you use both pbkdf2 and bcrypt/scrypt? Aren't they all basically doing the same thing?
Bcrypt is an algorithm which bundles up something which pbkdf2 achieves by iterating other algorithms. They're basically the same, but you should use bcrypt. You shouldn't use both of them, I'm guessing the poster above meant / rather than +. If you want more security, increase your (b|s)crypt work factor.
If for some reason you can't bring the bcrypt code into your project, you can implement pbkdf2 using basically a loop and your stdlib's hash functions.
Scrypt takes the whole concept of placing extra demands on the computer and applies it to the RAM rather than the CPU (perhaps as well as?,) the idea being that RAM is harder to accumulate in obscene quantities than CPU power.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#49The article explains how all the passwords were revealed except for "qeadzcwrsfxv1331". Maybe I missed it but could anybody point out to me which method revealed this password? The letters seem to not form any words that I know, and although is appended with a number and consists of only lower case letters, it's still 12-letters long, longer than any brute-forced in the article. Edit: They tried all the keyboard typi…
Try looking at the pattern the letters form on the keyboard...
Good catch, but it could also simply be that the password had been collected during a previous hack.
The article mentions it at the end but I think they should have insisted more on this point: if you have a very strong password that you reuse everywhere and it gets leaked at some point it has a high probability to end up in rainbow tables everywhere and might not be more secure than "h4x0r1234".
So using hard to guess passwords is the easy part, the hard part is using different hard to guess passwords everywhere.
Re: How crackers ransack passwords like “qeadzcwrsfxv1331”
#50Well the bonehead hashcat program is limited to 15 character passwords, so it can't possibly crack mine. The hashcat program software in general is powerful, though pretty crappy from a design standpoint. The current version crashes if any input is not what it expects, and it has just about zero help for what it expects. Actually I can't even get it to work, as executing hashcat-lite.exe with arguments causes it to j…
*Well the bonehead hashcat program is limited to 15 character passwords, so it can't possibly crack mine.*
Another massive annoyance is when a site has an insipid constraint on passwords. No longer than 8 chars because that's what they put in their db last century or based it on passwd, minimal symbols, and basically just alpha-numerics.
That's why your password manager has the controls on length, number of symbols, digits, etc. It's not to "smarten up" your passwords but to dumb them down for sites that give no priority to security.