Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Cracking with 8x Nvidia GTX 1080 Ti GPUs

servethehome.com

Post reply on HN
Print view View original

81–90 of 113 posts

Re: Password Cracking with 8x Nvidia GTX 1080 Ti GPUs

#81

Post by Tostino »

ThomasGeek wrote: post #72
pfalke wrote: post #68

Earlier quoted context omitted.

As a non-infosec guy, could someone shed more light on the implications for end users? I get that the combination of password reuse, short passwords and the fact that some services store passwords in plain text or as MD5 hashes makes it easy to break into accounts once a single service is compromised. So my takeaway is not to use longer passwords, but to use a password manager and have unique passwords for every serv…

Password managers are good but long passwords and password managers are better. If we are assuming MD5 then yes an 8 character password is not secure if someone is targeting you as it would take 10 hours to crack. If someone has a entire database of users let's say 50,000 users all with 8 character passwords then that would take 57 years to crack every password, so you may or may not be in the unlucky few that are at…

That 57 years is assuming they're storing their passwords MD5 hashed, with a salt (hah, i'm sure they thought of that if they're using MD5), and using the least efficient method possible to crack the passwords.

Re: Password Cracking with 8x Nvidia GTX 1080 Ti GPUs

#82

Post by dahart »

pfalke wrote: post #68
beefsack wrote: post #57

We all know MD5 is broken, but looking at it from purely a brute-force perspective: If you look at a US English keyboard, you've generally got 47 unique character keys. Let's double it and say there are 100 different characters you can type just using the character keys and shift. This machine could brute-force crack any 6 character password in under 4 seconds, any 7 character password in just over 6 minutes, and any…

As a non-infosec guy, could someone shed more light on the implications for end users? I get that the combination of password reuse, short passwords and the fact that some services store passwords in plain text or as MD5 hashes makes it easy to break into accounts once a single service is compromised. So my takeaway is not to use longer passwords, but to use a password manager and have unique passwords for every serv…

I'm personally convinced 8 chars is now too short to be safe, and I suspect real attacks are generally much faster than 8 hours for a password of that length.

Using a password manager to generate random passwords you get a way to be impervious to dictionary attacks, in addition to being able to generate and manage longer passwords. I'm generally using 20 char passwords, and I'd turn it up further if there weren't so many stupid websites that limit the max length of passwords to 20 characters.

For passwords I need to type, especially if I need them occasionally on a touch screen tablet, I'll use a long all-lowercase letters password. Some of them have a 'make pronounceable' option as well that gives random syllables and makes typing a 20 char password easier than typing an 8 char password of completely random characters. 20 chars of lowercase alpha is a lot more secure than 8 chars of mixed-case alphanumeric and punctuation.

Re: Password Cracking with 8x Nvidia GTX 1080 Ti GPUs

#83

Post by eightysixfour »

ihalip wrote: post #56
ASlave2Gravity wrote: post #48

Earlier quoted context omitted.

What's caused the price to rise so much the past few months?

IMO, this happened because of the Ethereum ICO fever. While there are a number of exchanges that allow you to trade USD -> BTC, there aren't as many that allow trading USD -> ETH. So there are people who might have traded USD -> BTC -> ETH, and this increased demand for BTC.

You can check this thesis pretty easily: https://coinmarketcap.com/currencies/volume/24-hour/

As you can see, ETH Fiat pairings have more volume than BTC -> ETH right now.

Re: Password Cracking with 8x Nvidia GTX 1080 Ti GPUs

#84

Post by strictnein »

bradleyjg wrote: post #76
pfalke wrote: post #68

Earlier quoted context omitted.

As a non-infosec guy, could someone shed more light on the implications for end users? I get that the combination of password reuse, short passwords and the fact that some services store passwords in plain text or as MD5 hashes makes it easy to break into accounts once a single service is compromised. So my takeaway is not to use longer passwords, but to use a password manager and have unique passwords for every serv…

In order of importance: 1) Don't use a really bad password like 'password'. This one is the most important because it might allow an attacker to compromise your accounts online--that is without compromising the site itself. 2) Use a different password for each site. This one is important because you don't want a compromise of smallvillelittleleague.org, which stores its passwords in plaintext, to mean that an attacke…

> 4) Use very strong passwords everywhere (i.e. long randomly generated).

You can also go the route of using passwords like:

   MyEmailIsFromGmail!
   or
   HackerNews?MoreLikeSlackerNews

Re: Password Cracking with 8x Nvidia GTX 1080 Ti GPUs

#85

Post by nly »

mrb wrote: post #19
cm2187 wrote: post #17

bcrypt: 21kH/s scrypt: 750kH/s The author didn't mention the work factor so I don't know how comparable the results are. But I thought the merit of scrypt over bcrypt was that it was memory hard, i.e. hard to run on a GPU. It doesn't seem to be the case.

The thing about bcrypt is that despite using small data structures in memory (kilobytes) it reads and writes and rewrites a lot of data into them (megabytes, when choosing common work factors). And the small size of its data structures is still just a bit too big to fit many parallel instances of bcrypt in GPU L2 caches. So it is effectively "memory hard" on GPUs. Contrast this with scrypt which writes memory (typica…

So one is memory capacity bound, and one is memory bandwidth bound.

Re: Password Cracking with 8x Nvidia GTX 1080 Ti GPUs

#86

Post by nly »

cm2187 wrote: post #17

bcrypt: 21kH/s scrypt: 750kH/s The author didn't mention the work factor so I don't know how comparable the results are. But I thought the merit of scrypt over bcrypt was that it was memory hard, i.e. hard to run on a GPU. It doesn't seem to be the case.

I wonder what the numbers are for Argon2

Re: Password Cracking with 8x Nvidia GTX 1080 Ti GPUs

#87

Post by dghughes »

nikcub wrote: post #50
Roritharr wrote: post #30

Earlier quoted context omitted.

The regret I feel having given away all of my 100 bitcoins at that price point will forever haunt me.

You can get over that feeling very quickly by reminding yourself to focus on what you might be missing out on today that you don't want to regret in years from now.

Ethereum.

Re: Password Cracking with 8x Nvidia GTX 1080 Ti GPUs

#88

Post by [deleted] »

mrb wrote: post #64
mtgx wrote: post #52

Earlier quoted context omitted.

> Moore's Law is still alive and kicking (contrary to what many claim)! That statement is so often misunderstood, in multiple ways. First off, Moore's Law isn't technically about performance increases. It's about doubling of transistors every 2 years on the same die space. We still got that on CPUs until very recently, even though CPU performance has stopped doubling every 2 years like 15 years ago. But now even the…

On a GPU more transistors = more compute units = more performance. Hence my over-simplification of Moore's Law. I strongly disagree that the rate of CPU perf improvement has slowed down "15 years ago". What a laughable statement. You have to look beyond core count to gauge performance. Microarchitectural improvements, new instruction sets (SSE, AVX), bigger caches, etc certainly still help keep the pace. Have a look:…

[deleted]

Re: Password Cracking with 8x Nvidia GTX 1080 Ti GPUs

#89

Post by bitL »

mrb wrote: post #18

In 2010 I built an 8-GPU machine[1] (4 dual-GPU AMD HD5970) and wrote an MD5 bruteforcer (then faster than hashcat), doing 28.6 then 33.1 billion passwd hashes/sec with a software optimization: http://blog.zorinaq.com/whitepixel-breaks-286-billion-passwo... It's interesting to note that 6.5 years later a single GPU like the Nvidia 1080 Ti can match the whole 2010 machine (32 billion hashes/sec). This is a doubling of…

> Moore's Law is still alive and kicking (contrary to what many claim)!

In GPUs, which is why tech that can take advantage of parallel processing such as Deep Learning, AR or coin mining has a bright future, whereas the rest is slowly falling into standardized oblivion with low-paying jobs.

Re: Password Cracking with 8x Nvidia GTX 1080 Ti GPUs

#90

Post by thatcat »

matt4077 wrote: post #58
nikcub wrote: post #50

Earlier quoted context omitted.

You can get over that feeling very quickly by reminding yourself to focus on what you might be missing out on today that you don't want to regret in years from now.

Or, alternatively, by remembering the efficient market hypothesis. And going for ice cream with someone you like.

That would be good consolation, but EMH doesn't really apply to emerging markets due to the large information gap about the market. So if you were part of the informed population and thought it was a good investment, but didn't follow through it's still pretty hard to not feel like you made a costly mistake.
Post reply on HN