It's nearly impossible to unscramble the hash if it is random.
It's trivial to unscramble hashed dictionary words with 123! or 2019! appended to the end.
Google should somehow note that distinction as it is important.
It's trivial to unscramble hashed dictionary words with 123! or 2019! appended to the end.
Google should somehow note that distinction as it is important.
Being able to make millions (or hundreds of millions or even billions) of guesses each second makes successful guessing more feasible.
If you can prove P = NP, then you have proved that no secure hash functions exist. (This is the contrapositive.)
(For a fun angle not related to complexity, the algorithm itself could be so large that it wouldn't fit in the observable universe without breaking the Bekenstein bound.)
And it has been a long time since I did proof theory, but is there the possibility of a non-constructive proof but no actual examples no matter how long you keep enumerating algorithms? Or a non-constructive proof, but no constructive proof? In that case there could be a "perfect heuristic"...
Because without that knowledge what would the attacker run their guesses through? And wouldn't that information be hard to get unless you had the full source code along with all relevant configuration?
Those 2 assumptions right there get you what you want 90% of the time.
As an attacker you're not trying to guess the hashed password and even if you had it you still would not be able to use it to log in. Hashing functions that are fit for real-world use are pure functions and their input cannot be determined by looking at their output, which renders rainbow tables (a list of plain text input and their corresponding hashed output) useless to attackers.
So knowing the hash function is useless and even if you also manage to access the database and get the hashed password you still need to run through a brute force technique to find which input gets that output. If the original password is itself a long random set of characters stored with Keychain or Onepass you’re looking at potentially trillions of attempts before you get it right. Hashing functions are written to be slow and computationally expensive so you’re going to incur a lot of energy costs by the time you get it. Also, you’ll be dead by then. When brute force works it’s because the password has no failure restrictions and is something short and simple like a mother’s maiden name with a zip code at the end.