4 ms·
What's shocking to me is that Yahoo! still uses MD5 hashes. Those can be decrypted almost instantly with hashcat and tools like it. There's some confusion about
by Jerry2 10y ago
What's shocking to me is that Yahoo! still uses MD5 hashes. Those can be decrypted almost instantly with hashcat and tools like it. There's some confusion about the age of data in question but I hope they've moved away from MD5 since the breach occurred.
- bduerst 10y agoThe hacked data is supposedly from 2012, which was four years after MD5 was declared broken as a form of encryption. Hopefully they've moved on by now.
- svenfaw 10y agoOnly for weak passwords. Strong (80-bit plus) passwords are still safe, even with unsalted MD5. Too bad people are really bad at choosing passwords.
- AdmiralAsshat 10y agoToo bad as well that very, very few sites support 80 character long passwords. Ever since I switched to a password manager, I've always made sure that the length of it is the maximum length that the site will accept. I am getting pretty pissed with the sites that have ridiculous "security" schemes like 1 capital letter, 1 one number, 1 special character, must rotate every three months...but will only allow a password between 8-12 characters long.
- jgalt212 10y agowait, which one is strong enough under MD5 hashing? 80 bit or 80 character?
- wolf550e 10y ago80 bits of entropy (20 really random hex chars) should be safe enough.
- deleted 10y ago[deleted]
- lmm 10y agoMD5 caps your overall complexity at 128 bits (realistically probably 110 bits with modern attacks). Typical english text has about 3 bits/character, completely random ascii is 7 bits/character (though that includes control codes you probably can't put in a password field). So 80 characters of typical English would be ~240 bits (obviously 80 characters of just 'aaa...' would be less), so definitely overkill for MD5; ~36 characters (110/3) is the point where you max out what you can do with MD5, and ~26 characters (80/3) is good enough. You can reduce these numbers a bit by using upper case, symbols etc., but personally I find it easier to remember 26 characters of normal English than 13 characters of random letters and symbols.
- Shivatron 10y agoGrandparent was suggesting that 80-bit, not 80-character, passwords were sufficient -- though I agree as a rule that more characters is generally better.