Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I mean, why not tell everyone our password hashes?

theobsidiantower.com

Post reply on HN
Print view View original

11–20 of 167 posts

Re: I mean, why not tell everyone our password hashes?

#11

Post by w8rbt »

It depends on the hash type. Cryptographic hashes (MD4, SHA1, SHA256, etc.) are made to be efficient and fast to compute while password hashes (bcrypt, scrypt, etc.) are much more difficult to compute. The difference is staggering.

  john --test --format=nt

  Benchmarking: NT [MD4 128/128 X2 SSE2-16]... DONE

  Raw:	29037K c/s real, 29037K c/s virtual



  john --test --format=bcrypt

  Will run 16 OpenMP threads

  Benchmarking: bcrypt ("$2a$05", 32 iterations) [Blowfish 32/64 X3]... (16xOMP) DONE

  Raw:	5472 c/s real, 490 c/s virtual
Edit: NT hashes are one round of MD4. These are Microsoft Active Directory hashes. OpenBSD uses Blowfish hashes by default.

Re: I mean, why not tell everyone our password hashes?

#12

Post by LinuxBender »

lucasgonze wrote: post #2

That inspired this idea: make all password databases public, in an encrypted form. Just post them in a standard location. This is to get rid of the fiction that these are ever private and to eliminate an incentive to break in.

They were being sarcastic.

Re: I mean, why not tell everyone our password hashes?

#13

Post by pmarreck »

a simple unsalted hash wouldn't work due to rainbow-tabling, and even a salted hash would be vulnerable to someone gaining unauthorized access to the salt and regenerating a rainbow table with it (although if one used bcrypt, that might be practically impossible)

Re: I mean, why not tell everyone our password hashes?

#14

Post by LinuxBender »

w8rbt wrote: post #11

It depends on the hash type. Cryptographic hashes (MD4, SHA1, SHA256, etc.) are made to be efficient and fast to compute while password hashes (bcrypt, scrypt, etc.) are much more difficult to compute. The difference is staggering. john --test --format=nt Benchmarking: NT [MD4 128/128 X2 SSE2-16]... DONE Raw: 29037K c/s real, 29037K c/s virtual john --test --format=bcrypt Will run 16 OpenMP threads Benchmarking: bcry…

What numbers does your rig give using hashcat and your video card?

Re: I mean, why not tell everyone our password hashes?

#15

Post by [deleted] »

w8rbt wrote: post #11

It depends on the hash type. Cryptographic hashes (MD4, SHA1, SHA256, etc.) are made to be efficient and fast to compute while password hashes (bcrypt, scrypt, etc.) are much more difficult to compute. The difference is staggering. john --test --format=nt Benchmarking: NT [MD4 128/128 X2 SSE2-16]... DONE Raw: 29037K c/s real, 29037K c/s virtual john --test --format=bcrypt Will run 16 OpenMP threads Benchmarking: bcry…

[deleted]

Re: I mean, why not tell everyone our password hashes?

#16

Post by ceejayoz »

kogepathic wrote: post #9
lucasgonze wrote: post #2

That inspired this idea: make all password databases public, in an encrypted form. Just post them in a standard location. This is to get rid of the fiction that these are ever private and to eliminate an incentive to break in.

> make all password databases public, in an encrypted form That is a terrible idea because agencies like the NSA or GCHQ with unfathomable resources and techniques will crack them and never tell anyone. Then you'll have a compromised account, the provider won't know, the user won't know. Then the agency would be able to compromise the account a publish whatever they wanted as that identity. Given there are tricks to…

> That is a terrible idea because agencies like the NSA or GCHQ with unfathomable resources and techniques will crack them and never tell anyone.

Chances are they already have 'em, from a compromised employee, a zero-day exploit, or a SQL injection hole. Far more likely than them having cracked bcrypt.

Re: I mean, why not tell everyone our password hashes?

#17

Post by ben_jones »

lucasgonze wrote: post #2

That inspired this idea: make all password databases public, in an encrypted form. Just post them in a standard location. This is to get rid of the fiction that these are ever private and to eliminate an incentive to break in.

The foundation of modern ecommerce rests on the belief that your credit card information won't be stolen and used to cause great harm. Similar belief systems exist for online dating, social media, etc.

Re: I mean, why not tell everyone our password hashes?

#18

Post by developer2 »

One reason: you'd be surprised how many companies allow entering the hash as an alternative password to login to customers' accounts in production. Lazy method for customer support teams who don't have support tools to access customer information. Also frequently done to allow developers to debug problems on a customer's account when a bug cannot be reproduced elsewhere.

If such a company's database of hashed passwords is leaked, then an attacker doesn't even have to crack the hashes - the hash itself is a valid version of the password. Yet I've seen this behavior at multiple companies; only one of them pushed back against my request to remove that "feature", and I didn't stay with them much longer after that.

Re: I mean, why not tell everyone our password hashes?

#19

Post by saulrh »

lucasgonze wrote: post #2

That inspired this idea: make all password databases public, in an encrypted form. Just post them in a standard location. This is to get rid of the fiction that these are ever private and to eliminate an incentive to break in.

That's what I thought when I read the title.

There's probably some reason it wouldn't work. Dictionary attacks are an obvious possibility; if your password is "password" the only thing you're depending on is nobody being able to get at the hashes. It might also expose password reuse, though nonces/salts might solve that. Hrm.

This smells a bit like public crypto - public database of public keys (hashes), on login you're challenged to produce proof that you have the private key (the password), and the transformation provides you a means to do that without exposing the private key itself.

Re: I mean, why not tell everyone our password hashes?

#20

Post by idlewords »

prostoalex wrote: post #3
lucasgonze wrote: post #2

That inspired this idea: make all password databases public, in an encrypted form. Just post them in a standard location. This is to get rid of the fiction that these are ever private and to eliminate an incentive to break in.

Make it blockchain-based, and you'll likely have some VC funding by tomorrow morning.

It's only 1 PM in California. This will be funded before sundown.
Post reply on HN