Hacker News Reader

Comment by teppopo | Hacker News Reader

How they crack the hashed passwords?

top 1000 passwords list + brute force + rainbow table + dictionary attack + fingerprinting attack.

All of that running on GPU. It's terribly effective. Even more so when 90% of accounts are throwaway/bots/fake accounts.

I'd make a blog post about cracking 99.7% of AdultFriendFinder passwords in 1 hour. But then I realized that it's evil and I shall not.

And what do they hit to make sure the password was cracked? Do they make bots to login? I don't understand.

SHA1 is a hashing algorithm (as opposed to an encryption algorithm), this means the string you're trying to hash will always have the same result. As an example, the string "password" will always have the same SHA1 hash (5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8). If you have the list of hashes, you can always find a lot of the passwords by using the techniques explained above.

Oh ok, I guess this doesn't happen with bcrypt, right? Because it spits out a different hash every time you hash it.

Uh? Of course not. It will spit out exactly the same hash every time, given the same input.

How else would you verify that the password matches ?

Try it, it doesn't. The Bcrypt algorithm generates salts and the salt is built into the outputted hash.

I don't know. Laravel uses a hash algorithm that uses bcrypt and never outputs the same hash.

Bcrypt uses 22 character salt.

The output of your library's BcryptEncoder.encode(password) includes not only the password hash but information about the algorithm and the salt. That's what you store in your database. That extra information tells the decode function how to decode later on.

See here:

http://stackoverflow.com/questions/6832445/how-can-bcrypt-ha...

Probably rainbow tables: https://en.wikipedia.org/wiki/Rainbow_table

The passwords shown were cracked with dictionary attacks. Rainbow tables are difficult to use in situations other than cracking up to a particular length using a specific character set, and even for that have little, if any speed advantage over modern GPUs.

Probably SHA-1 Rainbow tables.

Reply on news.ycombinator.com