11–20 of 77 posts
Every standard Windows password less than 8 chars only?
Upshot - it's impressive, but NTLM already known as an vulnerable target.
Every standard Windows password less than 8 chars only?
I know for practical purposes this doesn't seem like that big of a deal, but you have to understand that 8 chars of mixed case, numbers, and symbols is still a gigantic key space. That this can be done so quickly on commodity hardware is pretty impressive.
Look at the xkcd password entropy comic
Earlier quoted context omitted.
I know for practical purposes this doesn't seem like that big of a deal, but you have to understand that 8 chars of mixed case, numbers, and symbols is still a gigantic key space. That this can be done so quickly on commodity hardware is pretty impressive.
Individual char variance is less significant compared to additional chars. Look at the xkcd password entropy comic
Earlier quoted context omitted.
I'm sure they were able to crack the encryption method before Microsoft started using it.
Put your tin foil hats away. This doesn't "crack" NTLM, it brute forces at a very high rate. The NSA has more money to spend, but are similarly limited by the hardware available at any given point.
So they could have easily fabbed something like this, or a tuned architecture specifically designed for the purpose.
Impressive as the numbers are, it's worth remembering that this is an "offline crack", going against a stolen list of encrypted passwords. If they can steal your database of encrypted passwords, you've got a problem no matter how strong the passwords are. How many guesses per second do you get in a typical online crack? E.g., a script kiddie trying to guess your cloud server's SSH password?
The particularly persistent IPs get a special iptables rule.
Impressive as the numbers are, it's worth remembering that this is an "offline crack", going against a stolen list of encrypted passwords. If they can steal your database of encrypted passwords, you've got a problem no matter how strong the passwords are. How many guesses per second do you get in a typical online crack? E.g., a script kiddie trying to guess your cloud server's SSH password?
On my webserver, you get 3 chances and then a 24 hour ip ban. I think that comes out to 0.00003 passwords per second :) The particularly persistent IPs get a special iptables rule.
Earlier quoted context omitted.
On my webserver, you get 3 chances and then a 24 hour ip ban. I think that comes out to 0.00003 passwords per second :) The particularly persistent IPs get a special iptables rule.
Could you share the details of the implementation please?