Nvidia's flagship gaming GPU can crack complex passwords in under an hour
1–10 of 39 posts
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#2Using an 8 char password for those tests is very weak
On my old linux gaming rig with the AMD RX580 I can run through the entire WPA2 keyspace of 8 char lowercase or 8 char uppercase in 3 hours.
Md5 and sha1 takes seconds using JTR or hashcat masks or brute force or a straight attack using the Rust super fast Cracken password generator.
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#3Using an 8 char password for those tests is very weak On my old linux gaming rig with the AMD RX580 I can run through the entire WPA2 keyspace of 8 char lowercase or 8 char uppercase in 3 hours. Md5 and sha1 takes seconds using JTR or hashcat masks or brute force or a straight attack using the Rust super fast Cracken password generator.
Good spot. My passwords are ~20+ characters, so the title had me worried for a sec.
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#4By the way, I don't understand how does password cracking work on a site/system that has fail-to-ban?
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#5By the way, I don't understand how does password cracking work on a site/system that has fail-to-ban?
From the article:
> Servers store passwords in the form of hashes, so even if a hacker steals the database, they see the hashes, not the actual password.
So as I understand it, the article assumes that someone hacked a website where you had an account, and want to get your password (for the hacked website), in order to try using the same (username and) password to get access to your account on other websites.
Or, as other comments mentioned, they might intercept wifi authentication packets (which contain hash of the wifi password), and try to get wifi password from it.
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#6By the way, I don't understand how does password cracking work on a site/system that has fail-to-ban?
From the article: > Servers store passwords in the form of hashes, so even if a hacker steals the database, they see the hashes, not the actual password. So as I understand it, the article assumes that someone hacked a website where you had an account, and want to get your password (for the hacked website), in order to try using the same (username and) password to get access to your account on other websites. Or, as…
Ah yes, thanks for the clarification. So, two mishaps are needed for this to work: a site needs to be hacked and the user database stolen, and, a person needs to use the same user/password for all sites. Takeaway: never use the same password twice. Got it.
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#7Using an 8 char password for those tests is very weak On my old linux gaming rig with the AMD RX580 I can run through the entire WPA2 keyspace of 8 char lowercase or 8 char uppercase in 3 hours. Md5 and sha1 takes seconds using JTR or hashcat masks or brute force or a straight attack using the Rust super fast Cracken password generator.
Good spot. My passwords are ~20+ characters, so the title had me worried for a sec.
This and dice words for the win. God I hate password requirements that need special chars. Just add a min length and be done with it.
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#8Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#9Using an 8 char password for those tests is very weak On my old linux gaming rig with the AMD RX580 I can run through the entire WPA2 keyspace of 8 char lowercase or 8 char uppercase in 3 hours. Md5 and sha1 takes seconds using JTR or hashcat masks or brute force or a straight attack using the Rust super fast Cracken password generator.
Not to mention that they're using MD5, people have been recommending against for over a decade.
For the Bcrypt results waswas "99 years" even for an 8 character password (and with a work factor of 5, compared to the default of 10 in most libraries) - but that doesn't make for a a very good clickbaity headline, so they don't really talk about it.
Re: Nvidia's flagship gaming GPU can crack complex passwords in under an hour
#10Very click baity and not good journalism imho. Starting with a "A GeForce RTX 4090 could be cracking your password at this moment." tag line only to later note:
> With bcrypt, the hashing times soared. While the GeForce RTX 4090 only took 59 minutes to crack an MD5 hash, the same graphics card would need 99 years.
It's 2024 and if your password is still being hashed with md5, the news are: Your password could have been cracked 10 or more years ago already. Nobody sane uses that anymore and bcrypt still stands the test.