Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nvidia's flagship gaming GPU can crack complex passwords in under an hour

tomshardware.com

Post reply on HN
Print view View original

21–30 of 39 posts

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#21

Post by daveguy »

4death4 wrote: post #17
snowstormsun wrote: post #10

Very click baity and not good journalism imho. Starting with a "A GeForce RTX 4090 could be cracking your password at this moment." tag line only to later note: > With bcrypt, the hashing times soared. While the GeForce RTX 4090 only took 59 minutes to crack an MD5 hash, the same graphics card would need 99 years. It's 2024 and if your password is still being hashed with md5, the news are: Your password could have be…

So 99 of them could crack a password in 1 year? That is easily obtainable and not secure at all.

If your password is only 8 characters. I go with a minimum of 14. That means 99 years turns into heat death of the universe... Or a pipe wrench.

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#23

Post by NegativeK »

Shank wrote: post #16
Hasz wrote: post #14

If anything, this approach shows how good a system passwords are. The downfall will be cheap quantum computers; it seems like we have some time until those are available. An A100 is about $2/hr, so cracking even a "basic" password hashed with bcrypt is going to cost a cool $24M in GPU alone. Most people concerned about this kind of attack are using a whole lot more chars. Apps should not be using MD5, use pbkdf2 or b…

> The downfall will be cheap quantum computers; it seems like we have some time until those are available. This is limited to things that can be easily cracked with a quantum algorithm like public key cryptography via shor's algorithm. "Quantum computers won't solve hard problems instantly by just trying all solutions in parallel." -- Scott Aaronson

It's been a very long time, but: wouldn't Grover's algorithm apply to password hashes, shortening effective bit length by half?

That said, "double your password complexity/length" shouldn't be a problem if people are actually using password managers.

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#24

Post by 0cf8612b2e1e »

ses1984 wrote: post #13
atmanactive wrote: post #4

By the way, I don't understand how does password cracking work on a site/system that has fail-to-ban?

Generally speaking you can divide attacks like these into two types, online and offline. In an offline attack, the attacker has somehow gained access to some encrypted and/or hashed secrets, and they're trying to break the encryption or reverse the hash. There's nothing getting in their way except for time and compute power. In an online attack, there is some system in between the attacker and the target, like an aut…

Even if they did not explicitly implement rate limiting, an online attack is going to take enormously longer to execute. Querying an online service is going to add say 100msec roundtrip on top of the actual password hashing time.

I thought guidelines were that passwords should take 500msec to calculate. So, call it 600 msec per submitted password. Many servers will melt before being able to respond to any serious brute forcing attempt.

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#25

Post by entuno »

snowstormsun wrote: post #10

Very click baity and not good journalism imho. Starting with a "A GeForce RTX 4090 could be cracking your password at this moment." tag line only to later note: > With bcrypt, the hashing times soared. While the GeForce RTX 4090 only took 59 minutes to crack an MD5 hash, the same graphics card would need 99 years. It's 2024 and if your password is still being hashed with md5, the news are: Your password could have be…

And even worse, that's bcrypt with 32 iterations - a work factor of 5. Every Bcrypt implementation I've seen has a default work factor of 10 (1024 rounds), and people often use higher values that that.

So that 99 years is a massive underestimate for any actually secure password storage.

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#26

Post by thatguymike »

NegativeK wrote: post #18
snowstormsun wrote: post #10

Very click baity and not good journalism imho. Starting with a "A GeForce RTX 4090 could be cracking your password at this moment." tag line only to later note: > With bcrypt, the hashing times soared. While the GeForce RTX 4090 only took 59 minutes to crack an MD5 hash, the same graphics card would need 99 years. It's 2024 and if your password is still being hashed with md5, the news are: Your password could have be…

If you're a provider of some sort and storing passwords with MD5, shame on you. Or rc4. I'm looking at you, NTLM. If you're a user and you don't assume that some providers are using MD5... That's just excessively risky. It's not hard to manage passwords that can't be cracked regardless of the hashing algorithm.

What should I be doing to make a password that can't be cracked regardless of the hashing algorithm?

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#27

Post by Shank »

NegativeK wrote: post #23
Shank wrote: post #16

Earlier quoted context omitted.

> The downfall will be cheap quantum computers; it seems like we have some time until those are available. This is limited to things that can be easily cracked with a quantum algorithm like public key cryptography via shor's algorithm. "Quantum computers won't solve hard problems instantly by just trying all solutions in parallel." -- Scott Aaronson

It's been a very long time, but: wouldn't Grover's algorithm apply to password hashes, shortening effective bit length by half? That said, "double your password complexity/length" shouldn't be a problem if people are actually using password managers.

I suppose if we look at the world strictly in terms of a "classic" hash, I believe the answer is yes. However, "modern" password hashes are designed to be memory and CPU intensive. Scrypt hashes, for example, are designed to "waste" cycles and memory to bolster security. The size of the underlying password can remain static while the requirements imposed by scrypt can change.

Granted, I'm sure many sites are still using bad hash-based algorithms like md5 without salt today. But modern applications are often built with the goal of slowing down even offline attacks with salting, memory consumption, and CPU cycle consumption. The goal isn't just slow, but costly.

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#28

Post by lionkor »

thatguymike wrote: post #26
NegativeK wrote: post #18

Earlier quoted context omitted.

If you're a provider of some sort and storing passwords with MD5, shame on you. Or rc4. I'm looking at you, NTLM. If you're a user and you don't assume that some providers are using MD5... That's just excessively risky. It's not hard to manage passwords that can't be cracked regardless of the hashing algorithm.

What should I be doing to make a password that can't be cracked regardless of the hashing algorithm?

start using very high entropy passwords which contain just about all printable ascii characters, excluding whitespace.

If a computer cant guess it, it won't crack the hash, either.

Use a password manager and make those suckers 20-40 characters.

Use a master key that is just a super long phrase interleaved with special characters. Easy to remember. Like titles of books you like, plus authors, plus something only you know. Stuff like that.

I use a version of KeePass, with the actual file synced via syncthing to all devices plus a cloud.

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#29

Post by ranger_danger »

Pesthuf wrote: post #19

Not quite as unrealistic as it seems - I have colleagues I can’t convince that SHA-256 is NOT good for passwords. They just don’t understand that it’s safe for larger binaries, but absolutely not for short ASCII strings like passwords. Also they find it convenient since most modern programming languages and databases directly support those hash functions, but not something like bcrypt or Argon2. So I do think there a…

> SHA-256 is NOT good for passwords

Can you define SHA-256? And not good? Using it with PBKDF2/bcrypt/etc. seems to be widely accepted, but we don't know if you were referring to a single unsalted round of SHA-256 or what. Also by "not good" do you mean "easy to reverse the hash itself" or "easy to bruteforce the resulting password"? I think these questions make a big difference, e.g. you could have the most complex hashing algorithm on Earth, but if they're bruteforcing a three digit password, it doesn't matter.

(something something bitcoin uses sha2)

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#30

Post by lionkor »

I posted this below some comment but it may be worth reading for others:

start using very high entropy passwords which contain just about all printable ascii characters, excluding whitespace.

If a computer cant guess it, it won't crack the hash, either.

Use a password manager and make those suckers 20-40 characters.

Use a master key that is just a super long phrase interleaved with special characters. Easy to remember. Like titles of books you like, plus authors, plus something only you know. Stuff like that. Example: `Franz&Kafka$Meta-/morphosis@@3385`. Even better, use such helpers to make a high entropy string of random letters.

I use a version of KeePass, with the actual file synced via syncthing to all devices plus a cloud. To me, it has never been an issue to copy paste or auto type a 40 character password -- in fact, I usually dont even notice.

Post reply on HN