Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking WordPress passwords with 20 lines of Go

frenxi.com

Post reply on HN
Print view View original

11–20 of 21 posts

Re: Cracking WordPress passwords with 20 lines of Go

#11

Post by eyelidlessness »

guessmyname wrote: post #4

> Cracking WordPress passwords with 20 lines of Go The original title is actually “WordPress passwords, explained and cracked” . It seems Frenxi —the author— added “… with 20 lines of Go” in the post submission simply to appeal to the masses of Hacker News who often upvote links based on keywords more than the content of the article. Per the Hacker News Guidelines [1] → “[…] please use the original title, unless it i…

Maybe the interesting thing about it is that it doesn't require any interesting techniques to crack WP passwords? That seems interesting (although unsurprising having an early career background in PHP and WP) to me.

Re: Cracking WordPress passwords with 20 lines of Go

#14

Post by chx »

When I read "Bcrypt is known to be a stronger hashing method compared to md5" it is blatantly clear the author have missed the entire point of the phpass library. https://www.openwall.com/phpass/ to quote

> The approach of using multiple iterations to purposefully increase the computational cost of testing a password

The author has shown that a hashing function can be attacked by using a dictionary attack... well, yes, of course. But the library is not inherently weak just because of that. Yes, you can write it in 20 lines of Go but -- you'd need to benchmark the attack against other hashes. Just because the md5() primitive is used as part of the algorithm doesn't make the whole shebang weak.

The question always is how long it takes to find clear text which gets hashed to a certain value.

Re: Cracking WordPress passwords with 20 lines of Go

#15

Post by tambourine_man »

bretthopper wrote: post #13
tambourine_man wrote: post #12

Why does WordPress use md5? I understand that salting improves things quite a bit, but still. Doesn’t password_hash() use bcrypt by default? Why not use it?

https://github.com/roots/wp-password-bcrypt#the-problem

Nice, I’m glad such plug-in exists. My question is why hasn’t WP core adopted bcrypt yet. MD5 has been insecure for ages.

Re: Cracking WordPress passwords with 20 lines of Go

#16

Post by weewee2018 »

bretthopper wrote: post #13
tambourine_man wrote: post #12

Why does WordPress use md5? I understand that salting improves things quite a bit, but still. Doesn’t password_hash() use bcrypt by default? Why not use it?

https://github.com/roots/wp-password-bcrypt#the-problem

I’m not sure he mentions which version of Wordpress code he’s using.

Re: Cracking WordPress passwords with 20 lines of Go

#17

Post by tialaramex »

eyelidlessness wrote: post #11
guessmyname wrote: post #4

> Cracking WordPress passwords with 20 lines of Go The original title is actually “WordPress passwords, explained and cracked” . It seems Frenxi —the author— added “… with 20 lines of Go” in the post submission simply to appeal to the masses of Hacker News who often upvote links based on keywords more than the content of the article. Per the Hacker News Guidelines [1] → “[…] please use the original title, unless it i…

Maybe the interesting thing about it is that it doesn't require any interesting techniques to crack WP passwords? That seems interesting (although unsurprising having an early career background in PHP and WP) to me.

Given a password database, and the password check algorithm, this sort of dictionary or brute force approach is just a loop, regardless of the algorithm used because that's factored out.

Worse algorithms can offer the possibility of an exciting optimisation, especially for bulk cracking (e.g. Microsoft's LanMan Hash) - but that's not happening here.

In the case of this algorithm you could get a boost by vectorising to run on a GPU, memory hard pessimisation defeats that and this password hash doesn't offer it, again this Go program doesn't do that either.

For any human memorable password scheme, "Guess until you get lucky" is potentially viable and that's all this does, so it's almost the least interesting case.

Re: Cracking WordPress passwords with 20 lines of Go

#18

Post by fmajid »

chx wrote: post #14

When I read "Bcrypt is known to be a stronger hashing method compared to md5" it is blatantly clear the author have missed the entire point of the phpass library. https://www.openwall.com/phpass/ to quote > The approach of using multiple iterations to purposefully increase the computational cost of testing a password The author has shown that a hashing function can be attacked by using a dictionary attack... well, ye…

It’s 2020 and password-cracking is done on GPUs nowadays. The multiple rounds of PHPass do nothing against the speed of modern GPUs. You need a password hash that also requires a lot of RAM to compute to limit parallelism, like argon2 or scrypt.

Re: Cracking WordPress passwords with 20 lines of Go

#19

Post by frenxi »

Hey Folks, author here!

The post is just supposed to be a plain-text explanation of WordPress hashes, and the script is an explanatory POC.

As I mentioned, of course, there are more solid solutions out there but that's not the point.

Regarding the title, it was not supposed to be a clickbait. I just changed it to a more appropriate one :)

Hope you can take something good out of it.

Cheers, everybody!

Re: Cracking WordPress passwords with 20 lines of Go

#20

Post by dogma1138 »

fmajid wrote: post #18
chx wrote: post #14

When I read "Bcrypt is known to be a stronger hashing method compared to md5" it is blatantly clear the author have missed the entire point of the phpass library. https://www.openwall.com/phpass/ to quote > The approach of using multiple iterations to purposefully increase the computational cost of testing a password The author has shown that a hashing function can be attacked by using a dictionary attack... well, ye…

It’s 2020 and password-cracking is done on GPUs nowadays. The multiple rounds of PHPass do nothing against the speed of modern GPUs. You need a password hash that also requires a lot of RAM to compute to limit parallelism, like argon2 or scrypt.

It’s 2020 use OpenID Connect or any other “federated/delegated authentication” or anything else you may think off that doesn’t forces you to store passwords.
Post reply on HN