3 ms·
Whoever is trying to find a password that hashes to the known hash will order the passwords they try in order to prioritise testing more frequently used passwor
by ximeng 10y ago
Whoever is trying to find a password that hashes to the known hash will order the passwords they try in order to prioritise testing more frequently used passwords like aaaaaaaaaaaa rather than mj(8anZ0$uQ,! , so if you can encourage people to choose a less predictable password you increase the cost of discovering the password for an attacker.
- mmaunder 10y agoCorrect. They'll also start with dictionaries of a few hundred million passwords which they'll run through fairly quickly. Then they'll use mask attacks as @ximeng said in ascending order of length and complexity. https://hashcat.net/wiki/doku.php?id=mask_attack https://hashcat.net/wiki/doku.php?id=mask_attack So it's critically important to enforce length because short passwords will be cracked quickly even with slower hashing algorithms.