Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New 25 GPU Monster Devours Passwords In Seconds

securityledger.com

Post reply on HN
Print view View original

51–60 of 91 posts

Re: New 25 GPU Monster Devours Passwords In Seconds

#51

Post by raverbashing »

DanBC wrote: post #49
raverbashing wrote: post #23

Earlier quoted context omitted.

There you go 30 chars password don't matter. Sure, it's not low hanging fruit, but it's not troublesome if you're the target Why? Weakness 1: Because it's written down somewhere. Weakness 2..n: weaker links in the chain

> Weakness 1: Because it's written down somewhere. This should be part of your risk assessment. For most people and most passwords the risk is not someone riffling through your wallet to find the card with your 30 character password. The risk is from criminal gangs hacking a system and downloading a huge database of usernames / password hashes, and then performing an offline attack on those hashes. For most people wr…

True

That´s why I use a 'throwaway' password for most unimportant accounts. Sure, may be easy to break, but it isn't logging in to my gmail.

Don't forget also the risk of getting locked out of your account.

Re: New 25 GPU Monster Devours Passwords In Seconds

#53

Post by bigiain »

raverbashing wrote: post #51
DanBC wrote: post #49

Earlier quoted context omitted.

> Weakness 1: Because it's written down somewhere. This should be part of your risk assessment. For most people and most passwords the risk is not someone riffling through your wallet to find the card with your 30 character password. The risk is from criminal gangs hacking a system and downloading a huge database of usernames / password hashes, and then performing an offline attack on those hashes. For most people wr…

True That´s why I use a 'throwaway' password for most unimportant accounts. Sure, may be easy to break, but it isn't logging in to my gmail. Don't forget also the risk of getting locked out of your account.

I fell victim to that once, when I hadn't "upgraded" the re-used throwaway password I'd used to register to see what some random website was. When my throwaway password got exposed (in cleartext facepalm!) by PerlMonks, within a day or so someone had used it to send Acai Berry spam through my Twitter account (which 'd completely forgotten was still using a shared/throwaway password even though it had turned from "some random new website I was curious about" into "somewhere where I actually care about my online reputation").

Just don't re-used passwords _anywhere_ - choose a password generation/storage solution that works across all your devices, and use it to generate unique strong passwords for everything. (1PassWord + DropBox works great for me across my MacOSX, iOS, Android, and Windows devices - I occasionally would like it on Linux too, but rarely enough that I'm satisfied to use my phone and re-type passwords in Linux)

Re: New 25 GPU Monster Devours Passwords In Seconds

#54

Post by bigiain »

nemo1618 wrote: post #37
rorrr wrote: post #14

> That renders even the most secure password vulnerable to compute-intensive brute force No it doesn't. My passwords are 30-character randomly generated and look like this: T7PN2m7Yju43IWtoBkwL6TLx18Rdyq Do you want to guess how long it will take to bruteforce with that "monster"? (26 + 26 + 10)^30 = 5.91 × 10^53 possible combinations At 348 billion guesses per second it will take 1.53 × 10^42 seconds or 4.84 × 10^34…

Such passwords are certainly secure, but it's a pain to have to carry Keepass/other programs around when using other computers. I think I've found a happy medium by memorizing a simple password-generation function in my scripting language of choice. It produces sufficiently strong passwords, and if you're stranded without Keepass you can still generate them using a local interpreter or a site like codepad.org.

If you can sync your password safe aoftware to your phone, that pretty much solves that problem, at least for me.

(I also rely on having one of my phones or my iPad with me anytime I need secure access to any account of mine, 'cause I use two factor auth using TOTP tokens for places that support it like Google, Amazon, and Dropbox)

Re: New 25 GPU Monster Devours Passwords In Seconds

#55

Post by tux1968 »

wcoenen wrote: post #40
nemo1618 wrote: post #37

Earlier quoted context omitted.

Such passwords are certainly secure, but it's a pain to have to carry Keepass/other programs around when using other computers. I think I've found a happy medium by memorizing a simple password-generation function in my scripting language of choice. It produces sufficiently strong passwords, and if you're stranded without Keepass you can still generate them using a local interpreter or a site like codepad.org.

This doesn't work because there are conflicting rules out there about what a password should look like. Less than X chars, more than X chars, must contain certain chars, must'n contain certain chars... I use KeePass, with a copy (via dropbox) on my smartphone for when I'm not at my own computer.

My bank actually limits passwords to a maximum of 10 characters. Drives me bonkers because it prohibits my normal use of the Stanford PwdHash. Many other sites have "helpful" rules that get in the way as well. Frustrating.

Re: New 25 GPU Monster Devours Passwords In Seconds

#56

Post by himlion »

skriticos2 wrote: post #39

Cute. Following Bitcoin hash generation process, this looks like a toy. FPGA and ASIC hashing would be news on par with contemporary hash generation on smaller scale. This is just a better room heater. (i.e. hashing/W ratio is bad).

On the other hand hashing/$ invested is pretty good compared to fpga.

I don't think there are any vanilla SHA asics on a modern production process.

Re: New 25 GPU Monster Devours Passwords In Seconds

#57

Post by michaelt »

rmc wrote: post #47
michaelt wrote: post #35

Earlier quoted context omitted.

LinkedIn used unsalted SHA-1, had their passwords leaked, and within a month 90-95% of leaked passwords were cracked[1]. Admittedly LinkedIn isn't a critical application calling for people's most secure passwords - but it's evident that only 5-10% of users use passwords that take more than 1 month to crack when hashed with SHA-1. [1] http://securitynirvana.blogspot.co.uk/2012/06/final-word-on-...

Admittedly LinkedIn isn't a critical application calling for people's most secure passwords People re-use passwords. Often it's not access to the LinkedIn account that's the problem, but that that same password will give you access to their email account, after that, you have everything.

Yes, you're right about that. I only included that proviso because I've seen people on HN report that, while they use a complicated, hard-to-remember password for important sites (gmail, paypal) they use weaker/easier to remember/reused passwords on less important sites (HN, reddit, facebook, linkedin).

Depending on how widespread this behaviour is, while 90-95% of linkedin passwords were easily cracked, that might not generalise to all sites.

Re: New 25 GPU Monster Devours Passwords In Seconds

#58

Post by Keyframe »

peteretep wrote: post #8

The numbers are ... misleading ... and choosing NTLM hashes seems like bordering on misinformation. Taking SHA-1 (which YOU MUST NOT USE for password hashing blah), it manages 63 billion a second. To try all the passwords for that in the alphanumeric space: - 10 chars: 35 weeks - 11 chars: 44 years - 12 chars: 2,800 years - 16 chars: 11 times the age of the sun 10 chars for bcrypt: 600,000 years... http://www.wolfram…

I'm kind of rusty on algorithmic information theory (I'm an artist, heh)! Is there such a thing as (formalized) upper limit of what we could do as far as computing combinations go? I know of Kolmogorov complexity (vaguely), but what are the hard limits and challenges of just prodding through (faster and faster as tech goes forward) combinations until success? I plan on developing a story around that and make a movie out of it - so any help would be appreciated (you guys can contact me via email if you want).

Re: New 25 GPU Monster Devours Passwords In Seconds

#59

Post by takluyver »

bigiain wrote: post #53
raverbashing wrote: post #51

Earlier quoted context omitted.

True That´s why I use a 'throwaway' password for most unimportant accounts. Sure, may be easy to break, but it isn't logging in to my gmail. Don't forget also the risk of getting locked out of your account.

I fell victim to that once, when I hadn't "upgraded" the re-used throwaway password I'd used to register to see what some random website was. When my throwaway password got exposed (in cleartext facepalm! ) by PerlMonks, within a day or so someone had used it to send Acai Berry spam through my Twitter account (which 'd completely forgotten was still using a shared/throwaway password even though it had turned from "so…

If Linux support is more important, LastPass works very nicely. Although using it on mobile devices is a 'premium' feature, at $1 per month.

Re: New 25 GPU Monster Devours Passwords In Seconds

#60

Post by newman314 »

nwh wrote: post #17
akulbe wrote: post #4

I wonder what algorithm 1Password uses, and how it would fare, compared to the other options.

If you are genuinely interested in testing your 1Password keychain, the Jumbo builds of JTR include support for the agilekeychain, and some branches (Magnum Jumbo for example) offer OpenCL support for even faster attacks. I tried it against mine, and was significantly disappointed in how quickly even my laptop could attack it. I promptly increased the complexity of my master password.

What was it before (key length)? And what is it now?
Post reply on HN