Hacker News Reader

Comment by _cbsz | Hacker News Reader

> If they have root on your VM, they have your root password too. We're talking about maybe a couple hundred lines of code, tops.

The default hash for crypt(3) (and thus /etc/shadow) in newer Linux distributions is salted SHA-512. Shouldn't that be significantly more difficult to crack than the old MD5 hashes? john didn't even support it when I checked a few months ago.

View on HN

You don't have to crack it if you can just replace the login binary with one that logs it somewhere.

Oh, of course. I errantly assumed they didn't have root at the same time as you still had access.

In effect, No. The computing power required to crack SHA-512 is infinitesimal compared to that for, say, bcrypt. However, modern crypt() implementations support multiple rounds just like bcrypt and that would make it significantly more difficult (time-wise) to crack. But then again SHA-512 is already being replaced due to some potential flaws found, so.... shrug

Kind of pointless to crack your password, though. I mean, it's not like you use the same one for more than one account.

No of course not. I'm sure we all use a different password for every box, webapp account, registrar, email address etc. I myself keep 100 or so passwords in my head, just like everyone else...

i know right? after the 16th character in the 96-character set it gets a little tiresome to type but i think keeping my twitter account secure is worth it.

To be honest, I even don't know my remote passwords. They're completely random. I just use SSH keys.

1Password and encrypted text files serve well as a backup.

I agree with that completely. I use dsa for my boxes, but still there's so many other services I use where it isn't an option.

Reply on news.ycombinator.com