Hacker News Reader

Comment by zaroth | Hacker News Reader

Step 3 is not possible without one of the following;

  GitHub keeps a copy of the password in plain-text
  GitHub keeps a copy of the SHA1 hash of the password
  GitHub cracks the SHA1 hash and checks against their hash
  GitHub calculates the SHA1 hash of the password after a valid login

The 4th option is the only sane approach, but it means you can't 'Check if passwords are the same' in bulk, only as users login.

View on HN

The LinkedIn dump is trivial to convert back into plain text. They're all SHA1 hashes and aren't salted. You can just download an SHA1 rainbow table[0] and instantly convert them to plain text.

[0] http://project-rainbowcrack.com/table.htm

Correct me if I'm wrong, but rainbow table is for popular password and character combinations yes? If my password is s0m3th1nggsup33rhard, you cant make out the string from the rainbow table.

Depends on the specific rainbow table.

The ones I linked to are brute force, every single SHA1 hash for all common ascii characters up to 8 digits long. You can also download smaller rainbow tables for common passwords, dictionaries, or similar.

Ultimately SHA1 is extremely fast to commute in 2016. So even if a rainbow table doesn't suit your needs, you can easily generate a new one which does, but likely you'll break a good chunk of passwords just using the "out of the box" 1-9 A-Za-z0-9 and specials rainbow tables.

You're wrong. It's not just a dictionary. While tables are generated with a cap on length and characters used that's not the same as being for popular passwords.

Reply on news.ycombinator.com