Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking 14 Character Complex Passwords in 5 Seconds

ciozone.com

Post reply on HN
Print view View original

11–20 of 64 posts

Re: Cracking 14 Character Complex Passwords in 5 Seconds

#11

Post by SriniK »

nikcub wrote: post #5

With a separate salt for each password the rainbow table becomes useless. If an attacker has both the salt and the hash, they are back to computing the table (brute force)

Yup. Right on - +5

I am not familiar with windows password scheme but it would be crazy if windows just relied on the hash. Few *nix machines that I deal with have 128 bit salt + password.

Even wifi-wpa, blackberry and iphones are doing password strengthening to make brute force method more challenging.

As most of us are familiar with, most vulnerable part of the security is us human beings picking the passwords. Underneath algorithms(hashing) are pretty well devised and solid when used properly.

Re: Cracking 14 Character Complex Passwords in 5 Seconds

#13

Post by hyuen »

jackowayed wrote: post #4

If they're really just using 80GB on the SSD (as the linked-to article suggests), why not just use a server with 128GB of RAM and avoid writing to disk altogether?

This is a perfect example of what can you do with RAM that is one order of magnitude bigger than what you can normally afford in regular computers.

It would be interesting to see if the effort that is spent writing programs to load stuff from disk and avoiding seeks gets redirected to solve other problems.

Re: Cracking 14 Character Complex Passwords in 5 Seconds

#14

Post by mrb »

peterwwillis wrote: post #8

People, NTLM hashes have been dead for years. Stop using them. http://support.microsoft.com/kb/299656

You are confusing NTLM hashes with LM hashes.

The article you point to is about LM hashes, not NTLM hashes. There is no way to stop using NTLM hashes on Windows.

Re: Cracking 14 Character Complex Passwords in 5 Seconds

#16

Post by InclinedPlane »

potatolicious wrote: post #6
jackowayed wrote: post #4

If they're really just using 80GB on the SSD (as the linked-to article suggests), why not just use a server with 128GB of RAM and avoid writing to disk altogether?

True, but I suspect a 80GB SSD is a lot easier to afford for your common basement hacker than a box with 128GB of RAM.

By roughly a factor of 10, not including the motherboard costs (since most boards don't support 128gb of ram).

Re: Cracking 14 Character Complex Passwords in 5 Seconds

#17

Post by InclinedPlane »

nikcub wrote: post #5

With a separate salt for each password the rainbow table becomes useless. If an attacker has both the salt and the hash, they are back to computing the table (brute force)

If the salt is short (username, email address, phone number, user id, etc.) then this becomes much more of a serious attack, specifically if the salt+password combination is less than 14 characters.

Re: Cracking 14 Character Complex Passwords in 5 Seconds

#18

Post by ma2rten »

jmtulloss wrote: post #10
potatolicious wrote: post #6

Earlier quoted context omitted.

True, but I suspect a 80GB SSD is a lot easier to afford for your common basement hacker than a box with 128GB of RAM.

23GB of ram on EC2 is 1.60 an hour. Spin up 10 for $16.00. I think most hackers can afford that and it gives them enough computing power to match an 80GB SSD, I would say.

I guess most hackers would rather do it at home ...

Re: Cracking 14 Character Complex Passwords in 5 Seconds

#19

Post by blaix »

Groxx wrote: post #15

Apparently "cracking" now means "looking up in a big list".

I thought the same thing. "With a big dictionary we can lookup easy passwords. With a bigger dictionary and a faster hard drive we can lookup complex passwords!" Is that all that's happening here or am I missing something?

Re: Cracking 14 Character Complex Passwords in 5 Seconds

#20

Post by _b8r0 »

The rainbow tables are an implementation of a form of time-memory tradeoff attack using a refined hash reduction algorithm based on the work of Martin Hellman (of Diffie-Hellman fame) - http://en.wikipedia.org/wiki/Rainbow_table

Basically Ophcrack uses optimised hash chains to speed things up. The precomputed hashes are generated with a specific character set. This works particularly well for unsalted algorithms that support limited character sets such as LM. LM splits the password into two on the 7 character boundary, capitalises it and only supports a subset of printable characters. Also it's unsalted, so while more computationally expensive than NTLM it's actually easier to crack. Rainbow tables for LM can be downloaded from freerainbowtables.net and are about 30-40Gb.

NTLM on the other hand supports unicode and very long password lengths. Most rainbow tables are mixalpha, or alphanumeric but short length. Our mixalphanum with symbols rainbow table set goes up to 14 characters and is about just under a terabyte. This is more difficult to put on SSDs cheaply.

Your best bet to protecting from rainbow tables is to use a character not referenced in commonly available sets in your password as you inevitably otherwise reach the limits of security vs usability with exceptionally long characters. As I use british keyboards, I generally recommend the £ symbol (British pound) or accent over a vowel. The Euro symbol is also good if you're staying in Europe.

Post reply on HN