21–29 of 29 posts
I can recommend Hashcat, used it myself for cracking bitcoin wallet using multiple GPUs. Great tool if you forget your password and it works with so many applications/file formats.
I thought cracking a bitcoin wallet was technically beyond the limitations of today's computing power??
Earlier quoted context omitted.
I hope you remember that GPG keys created on a Yubikey are unsafe, due to an overly simply RSAlib implementation there for their Infinion chips.
Keys created on _some_ Yubikeys (it's easy enough to check).
Earlier quoted context omitted.
Keys created on _some_ Yubikeys (it's easy enough to check).
I've had a really hard time finding information on this. What exactly is potentially broken and how do I check my key?
This reminds me to move to passwordstore with a gpg key on an Yubikey.
I hope you remember that GPG keys created on a Yubikey are unsafe, due to an overly simply RSAlib implementation there for their Infinion chips.
Additionally, you can always generate GPG keys on your machine, transfer them to the YubiKey, and then delete the keys from the local machine. It depends if that's an acceptable exposure for your threat model, but for me, having the keys locally for a couple minutes is fine.
Will this work on a something like a 100 character plaintext password that was written down with 3 transcription errors? Can it try all permutations of the 100 char password changing up to 3 characters at a time?
I made this a while back to ease the barrier to entry to Hashcat: https://github.com/brannondorsey/naive-hashcat Not that it's that big of a barrier, but it can be somewhat daunting to new password crackers.
Or, if you want to get experimental with it, I've been working on a distributed browser password cracker here: https://github.com/brannondorsey/distributed-password-cracki... . It can be embedded in websites to borrow your visitor's CPU cycles to crack md5 hashes.Note that it is very slow in comparison to Hashcat, but its a proof-of-concept for something that I am hoping to soon add WebAssembly + WebGL GPGPU cracking…
https://news.ycombinator.com/item?id=15528247
https://news.ycombinator.com/item?id=15470244
https://news.ycombinator.com/item?id=15333899
https://news.ycombinator.com/item?id=15270799
https://news.ycombinator.com/item?id=15246145 https://news.ycombinator.com/item?id=15124211
(All 40+ comments within the past ~2 months)
This reminds me to move to passwordstore with a gpg key on an Yubikey.
I hope you remember that GPG keys created on a Yubikey are unsafe, due to an overly simply RSAlib implementation there for their Infinion chips.
That way I don't have deal with different subkeys and other complications that just makes everything hard to understand :)