Live data from Hacker News

I mean, why not tell everyone our password hashes?

theobsidiantower.com

141–150 of 167 posts

Re: I mean, why not tell everyone our password hashes?

#141

What exactly are these passwords used for? The post mentions "controlling this object in the RIPE database" but I'm missing some context necessary to understand that.

Basically you can take ownership of their IP ranges, modify routing information, etc.

Even if you took a small percentage of the IP addresses in Europe, this could have a snowball effect. You take the IP addresses belonging to a popular mail service used by other domains, then you use admin email addresses to reset and eventually Europes internet is stolen.

Re: I mean, why not tell everyone our password hashes?

#142

Earlier quoted context omitted.

No, by all means share the MD5 hash of your passwords. After all it's a one way hash. /S

It's my understanding that even an MD5 hash of a not-terrible password is still virtually impossible to crack, is that wrong? Here's an md5 sum of a not-that-great password I just made up. It's 14 characters long, but has plenty of guessable features. Is it crackable? 1cf016ea3cb1f2aa2ccb59c196d0e704

I see a lot of people saying how easy it would be to crack this, but I don't see it cracked...

Re: I mean, why not tell everyone our password hashes?

#143

Earlier quoted context omitted.

It's my understanding that even an MD5 hash of a not-terrible password is still virtually impossible to crack, is that wrong? Here's an md5 sum of a not-that-great password I just made up. It's 14 characters long, but has plenty of guessable features. Is it crackable? 1cf016ea3cb1f2aa2ccb59c196d0e704

In reality while that would be really easy to crack (measured in minutes as others pointed out). However, any possible password with a standard printable ASCII character set will typically be found in Rainbow tables up to 10 characters long making expensive cracking unnecessary. [not quite right see edit] Rainbow tables are just giant tables where the key is the hash and the value is the string that generated it. How…

If you know the md5 hash, why not login with another password that generates the same hash value? Does it actually need to be the same passord?

Re: I mean, why not tell everyone our password hashes?

#144

Earlier quoted context omitted.

In reality while that would be really easy to crack (measured in minutes as others pointed out). However, any possible password with a standard printable ASCII character set will typically be found in Rainbow tables up to 10 characters long making expensive cracking unnecessary. [not quite right see edit] Rainbow tables are just giant tables where the key is the hash and the value is the string that generated it. How…

If you know the md5 hash, why not login with another password that generates the same hash value? Does it actually need to be the same passord?

Yes, that will also work, hence why rainbow tables don't need to contain more entries than the possible set of hashes.

Re: I mean, why not tell everyone our password hashes?

#145

Earlier quoted context omitted.

In reality while that would be really easy to crack (measured in minutes as others pointed out). However, any possible password with a standard printable ASCII character set will typically be found in Rainbow tables up to 10 characters long making expensive cracking unnecessary. [not quite right see edit] Rainbow tables are just giant tables where the key is the hash and the value is the string that generated it. How…

If you know the md5 hash, why not login with another password that generates the same hash value? Does it actually need to be the same passord?

[deleted]

Re: I mean, why not tell everyone our password hashes?

#146

Earlier quoted context omitted.

2048 is enough.

For now. https://www.keylength.com/en/compare/ Why risk it when generating an ed25519 or rsa4096 keypair is cheap?

The same logic would apply to an 8192 bit key. One more bit doubles the key space. Someone who is be able to crack 2048 bit keys, probably also has the opportunity to crack 4096 bit keys. It may not be cheap for your communication partners to use your 4096 bit key. Smartphones and embedded devices want to use as less energy as possible. With an 4096 bit key, you force your communication partners to spent an unnecessary amount of energy.

Re: I mean, why not tell everyone our password hashes?

#147

What exactly are these passwords used for? The post mentions "controlling this object in the RIPE database" but I'm missing some context necessary to understand that.

Basically you can take ownership of their IP ranges, modify routing information, etc. Even if you took a small percentage of the IP addresses in Europe, this could have a snowball effect. You take the IP addresses belonging to a popular mail service used by other domains, then you use admin email addresses to reset and eventually Europes internet is stolen.

It's not quite that simple. The RIPE database stores mostly administrative information, and doesn't _directly_ affect Internet routing.

In order to "steal" IP addresses (get them routed to you) you would need to buy a connection to at least one exchange point, probably several if you want all the traffic for the target to route to you and not just some traffic from some networks. You'd need to buy rackspace somewhere with a connection to the exchange point, install routers, establish BGP peerings with the exchange point (if they're doing route reflection) or with all the other major networks at the exchange.

There are multiple steps along the way where humans would look at the prefixes you were going to be announcing. This would include looking them up in RIPE, but anything more than a cursory inspection would likely reveal your ruse.

At this point it becomes more of a social engineering attack, and even if you got as far as announcing it, there are things like BGPMon that would pick up the fraudulent announcement pretty quickly and you'd likely find that the cable was pulled out of your router pretty fast.

Re: I mean, why not tell everyone our password hashes?

#148

Earlier quoted context omitted.

It's my understanding that even an MD5 hash of a not-terrible password is still virtually impossible to crack, is that wrong? Here's an md5 sum of a not-that-great password I just made up. It's 14 characters long, but has plenty of guessable features. Is it crackable? 1cf016ea3cb1f2aa2ccb59c196d0e704

I see a lot of people saying how easy it would be to crack this, but I don't see it cracked...

"Very easy to crack this! You just need a bajillion dollars, 5000 AWS instances and a couple minutes!"

Not surprised why no one tried yet.

Re: I mean, why not tell everyone our password hashes?

#149
post #68

Earlier quoted context omitted.

I doubt they have exploited every single password DB in existence.

If they want it, they can get it.

That's still a better status quo than passively having access to all of it.

Re: I mean, why not tell everyone our password hashes?

#150

Earlier quoted context omitted.

I see a lot of people saying how easy it would be to crack this, but I don't see it cracked...

"Very easy to crack this! You just need a bajillion dollars, 5000 AWS instances and a couple minutes!" Not surprised why no one tried yet.

I think it's a reasonable point. There's lots of armchair experts saying that md5 is broken, unusable, and anyone can reverse it, and here we are 14 hours later and nobody has proven it. Given that the claim was 12 minutes on a 25 machine cluster, that would imply 300 minutes of compute time which is 6 hours. This is hacker news, if it's not going to be done here, then no armchair enthusiasts are going to do it.

If someone can point me towards the tools and how to set it up, I'll leave my gtx1070 at it overnight and see.

Post reply on HN