The label password is terrible. It implies that a single word is sufficient.
Something like secret or key would probably have been more appropriate in hindsight.
Nvidia's flagship gaming GPU can crack complex passwords in under an hour
11–20 of 39 posts
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#12Earlier quoted context omitted.
From the article: > Servers store passwords in the form of hashes, so even if a hacker steals the database, they see the hashes, not the actual password. So as I understand it, the article assumes that someone hacked a website where you had an account, and want to get your password (for the hacked website), in order to try using the same (username and) password to get access to your account on other websites. Or, as…
Ah yes, thanks for the clarification. So, two mishaps are needed for this to work: a site needs to be hacked and the user database stolen, and, a person needs to use the same user/password for all sites. Takeaway: never use the same password twice. Got it.
AND that site has to be using unsalted MD5 password hashes, in which case you were already doomed
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#13By the way, I don't understand how does password cracking work on a site/system that has fail-to-ban?
Generally speaking you can divide attacks like these into two types, online and offline.
In an offline attack, the attacker has somehow gained access to some encrypted and/or hashed secrets, and they're trying to break the encryption or reverse the hash. There's nothing getting in their way except for time and compute power.
In an online attack, there is some system in between the attacker and the target, like an authentication server, that can implement stuff like fail2ban, captchas, rate limiting, etc.
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#14If anything, this approach shows how good a system passwords are. The downfall will be cheap quantum computers; it seems like we have some time until those are available.
An A100 is about $2/hr, so cracking even a "basic" password hashed with bcrypt is going to cost a cool $24M in GPU alone. Most people concerned about this kind of attack are using a whole lot more chars. Apps should not be using MD5, use pbkdf2 or bcrypt.
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#15Very click baity and not good journalism imho. Starting with a "A GeForce RTX 4090 could be cracking your password at this moment." tag line only to later note: > With bcrypt, the hashing times soared. While the GeForce RTX 4090 only took 59 minutes to crack an MD5 hash, the same graphics card would need 99 years. It's 2024 and if your password is still being hashed with md5, the news are: Your password could have be…
[deleted]
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#16If anything, this approach shows how good a system passwords are. The downfall will be cheap quantum computers; it seems like we have some time until those are available. An A100 is about $2/hr, so cracking even a "basic" password hashed with bcrypt is going to cost a cool $24M in GPU alone. Most people concerned about this kind of attack are using a whole lot more chars. Apps should not be using MD5, use pbkdf2 or b…
> The downfall will be cheap quantum computers; it seems like we have some time until those are available.
This is limited to things that can be easily cracked with a quantum algorithm like public key cryptography via shor's algorithm.
"Quantum computers won't solve hard problems instantly by just trying all solutions in parallel." -- Scott Aaronson
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#17Very click baity and not good journalism imho. Starting with a "A GeForce RTX 4090 could be cracking your password at this moment." tag line only to later note: > With bcrypt, the hashing times soared. While the GeForce RTX 4090 only took 59 minutes to crack an MD5 hash, the same graphics card would need 99 years. It's 2024 and if your password is still being hashed with md5, the news are: Your password could have be…
So 99 of them could crack a password in 1 year? That is easily obtainable and not secure at all.
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#18Very click baity and not good journalism imho. Starting with a "A GeForce RTX 4090 could be cracking your password at this moment." tag line only to later note: > With bcrypt, the hashing times soared. While the GeForce RTX 4090 only took 59 minutes to crack an MD5 hash, the same graphics card would need 99 years. It's 2024 and if your password is still being hashed with md5, the news are: Your password could have be…
If you're a provider of some sort and storing passwords with MD5, shame on you. Or rc4. I'm looking at you, NTLM.
If you're a user and you don't assume that some providers are using MD5... That's just excessively risky.
It's not hard to manage passwords that can't be cracked regardless of the hashing algorithm.
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#19Not quite as unrealistic as it seems - I have colleagues I can’t convince that SHA-256 is NOT good for passwords.
They just don’t understand that it’s safe for larger binaries, but absolutely not for short ASCII strings like passwords. Also they find it convenient since most modern programming languages and databases directly support those hash functions, but not something like bcrypt or Argon2.
So I do think there are many passwords out there you can crack easily and quickly nowadays.
I’ll try convincing them again…
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#20If anything, this approach shows how good a system passwords are. The downfall will be cheap quantum computers; it seems like we have some time until those are available. An A100 is about $2/hr, so cracking even a "basic" password hashed with bcrypt is going to cost a cool $24M in GPU alone. Most people concerned about this kind of attack are using a whole lot more chars. Apps should not be using MD5, use pbkdf2 or b…
Quantum computers only provide a quadratic advantage to breaking hashes, using Grover's algorithm. This quadratic advantage will likely not be sufficient to overcome the enormous overheads of quantum computing for many decades. Especially since the higher the level of parallelism the smaller the benefit you get from Grover's algorithm.