Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nvidia's flagship gaming GPU can crack complex passwords in under an hour

tomshardware.com

Post reply on HN
Print view View original

31–39 of 39 posts

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#31

Post by Hasz »

Shank wrote: post #16
Hasz wrote: post #14

If anything, this approach shows how good a system passwords are. The downfall will be cheap quantum computers; it seems like we have some time until those are available. An A100 is about $2/hr, so cracking even a "basic" password hashed with bcrypt is going to cost a cool $24M in GPU alone. Most people concerned about this kind of attack are using a whole lot more chars. Apps should not be using MD5, use pbkdf2 or b…

> The downfall will be cheap quantum computers; it seems like we have some time until those are available. This is limited to things that can be easily cracked with a quantum algorithm like public key cryptography via shor's algorithm. "Quantum computers won't solve hard problems instantly by just trying all solutions in parallel." -- Scott Aaronson

Totally fair, I am conflating two pretty different things.

For symmetric crypto, there is Grover's algorithm, which we can mitigate by just doubling key size. However, for asymmetric crypto, shor's algorithm is going to wreck it; intelligence agencies are hoovering up traffic right now to crack latter when it's cheaply available.

I would point out the field is in its infancy and new attacks/discoveries will be made that will change things dramatically. These attacks also depend on having access to a "sufficiently large" quantum computer, which in my amateur opinion is 10s of years away from public availability.

There is a whole field of "post-quantumn" cryptography being discussed now, but they not really standard or ready for prime-time afaik.

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#32

Post by ranger_danger »

matthewmacleod wrote: post #12
atmanactive wrote: post #6

Earlier quoted context omitted.

Ah yes, thanks for the clarification. So, two mishaps are needed for this to work: a site needs to be hacked and the user database stolen, and, a person needs to use the same user/password for all sites. Takeaway: never use the same password twice. Got it.

AND that site has to be using unsalted MD5 password hashes, in which case you were already doomed

Salts do not make brute-forcing any more "difficult" though if that's the method you're using to crack with.

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#33

Post by dietr1ch »

reify wrote: post #2

Using an 8 char password for those tests is very weak On my old linux gaming rig with the AMD RX580 I can run through the entire WPA2 keyspace of 8 char lowercase or 8 char uppercase in 3 hours. Md5 and sha1 takes seconds using JTR or hashcat masks or brute force or a straight attack using the Rust super fast Cracken password generator.

To be fair, everytime a privacy leak is reported we may be looking at old code or careless devs that may have used m5d or things like length as a hash function.

But yeah, a big goal here was to be as clickbaity as possible.

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#34

Post by Pesthuf »

ranger_danger wrote: post #29
Pesthuf wrote: post #19

Not quite as unrealistic as it seems - I have colleagues I can’t convince that SHA-256 is NOT good for passwords. They just don’t understand that it’s safe for larger binaries, but absolutely not for short ASCII strings like passwords. Also they find it convenient since most modern programming languages and databases directly support those hash functions, but not something like bcrypt or Argon2. So I do think there a…

> SHA-256 is NOT good for passwords Can you define SHA-256? And not good? Using it with PBKDF2/bcrypt/etc. seems to be widely accepted, but we don't know if you were referring to a single unsalted round of SHA-256 or what. Also by "not good" do you mean "easy to reverse the hash itself" or "easy to bruteforce the resulting password"? I think these questions make a big difference, e.g. you could have the most complex…

I thought it was obvious since I mentioned bcrypt and argon 2 later that I meant plain, simple, single round SHA-256. Usually salted, but there's one database where they're not, for some weird MySQL view compatibility hack that allows reusing the accounts and password hashes in a different legacy application that doesn't support salts whatsoever.

The reasons why this is terrible for storing password hashes are widely known, everyone else in the comments is already talking about how you're meant to use something like PBKDF2 or bcrypt instead, so I didn't see the need to put an explanation nobody needs in my comment.

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#36

Post by SebFender »

4death4 wrote: post #17
snowstormsun wrote: post #10

Very click baity and not good journalism imho. Starting with a "A GeForce RTX 4090 could be cracking your password at this moment." tag line only to later note: > With bcrypt, the hashing times soared. While the GeForce RTX 4090 only took 59 minutes to crack an MD5 hash, the same graphics card would need 99 years. It's 2024 and if your password is still being hashed with md5, the news are: Your password could have be…

So 99 of them could crack a password in 1 year? That is easily obtainable and not secure at all.

It doesn't work that way - and if it did - it's absolutely acceptable in most, if not all systems. A year to "break something" is absolutely considered secure in risk management of larger systems.

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#37

Post by matthewmacleod »

ranger_danger wrote: post #32
matthewmacleod wrote: post #12

Earlier quoted context omitted.

AND that site has to be using unsalted MD5 password hashes, in which case you were already doomed

Salts do not make brute-forcing any more "difficult" though if that's the method you're using to crack with.

Of course this is correct (merely makes it so that you have to brute force instead of look up in your book)!

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#38

Post by 4death4 »

SebFender wrote: post #36
4death4 wrote: post #17

Earlier quoted context omitted.

So 99 of them could crack a password in 1 year? That is easily obtainable and not secure at all.

It doesn't work that way - and if it did - it's absolutely acceptable in most, if not all systems. A year to "break something" is absolutely considered secure in risk management of larger systems.

How does it not work that way? Password cracking is infinitely parallelizable.

Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour

#39

Post by SebFender »

4death4 wrote: post #38
SebFender wrote: post #36

Earlier quoted context omitted.

It doesn't work that way - and if it did - it's absolutely acceptable in most, if not all systems. A year to "break something" is absolutely considered secure in risk management of larger systems.

How does it not work that way? Password cracking is infinitely parallelizable.

Technically yes - but when it comes to attacks not really. If someone wants it, you have much easier and faster techniques.
Post reply on HN