591–596 of 596 posts
Earlier quoted context omitted.
leaking unsalted md5 passwords == leaking passwords
Not if it's my password. I use ~100 bits of entropy.
Earlier quoted context omitted.
You are describing a first preimage attack. There have not been any computable first (or second) preimage attacks on md5. https://stackoverflow.com/questions/822638/does-any-publishe... There are collision attacks, but that is not relevant for password cracking.
From 2009: a preimage attack reduced the complexity from 2^128 to 2^123.4 [1]. It's still a big number, but it's less than the theoretical complexity. [1] https://www.iacr.org/archive/eurocrypt2009/54790136/54790136...
Earlier quoted context omitted.
Not if it's my password. I use ~100 bits of entropy.
Hence "Strong passwords that need to be memorized " in OP's comment. Or else your memory is way better than mine (or I care way less, or probably both).
I use a password database so I don't memorize most of my passwords.
Earlier quoted context omitted.
What do you mean by a password that can't be reasonably brute forced? EDIT: To clarify, I mean specifically with md5. I'm by no means an expert, just curious because I had considered md5 so broken that this comment caught my attention.
Rumours of MD5's death have been greatly exaggerated. MD5's weakness is that it's (relatively) easy to produce two strings which have the same hash. However, given an MD5 hash, it's not easy to produce a string which also has that hash. In principle , one could intentionally construct two passwords which have the same hash. It's hard to see how that could be exploited maliciously - any attacker knows both passwords t…
Earlier quoted context omitted.
Hence "Strong passwords that need to be memorized " in OP's comment. Or else your memory is way better than mine (or I care way less, or probably both).
Whether they need to be memorized or not does not make the statement "it will be leaked eventually anyway" more true. I use a password database so I don't memorize most of my passwords.
Earlier quoted context omitted.
Whether they need to be memorized or not does not make the statement "it will be leaked eventually anyway" more true. I use a password database so I don't memorize most of my passwords.
Well, it does, because memory puts some limitations on length and complexity...
I agree that it's not worth memorizing, you should instead use a password database. But I still maintain my original point that there's no reason to assume that your password will be leaked eventually if you use a strong password.