4 ms·

I’ve once used my PC for the same thing, the result was OK. Based on raw performance, my GTX 960 GPU is 4.5 times slower than a single 1080 Ti, and thus 36 time

I’ve once used my PC for the same thing, the result was OK. Based on raw performance, my GTX 960 GPU is 4.5 times slower than a single 1080 Ti, and thus 36 times slower than 8x 1080 Ti’s. My GPU was able to try 20GB passwords in a couple of minutes. That was the largest password list I’ve found on the internets. However, neither system can brute force even a short 8 characters password. If the password is lower+upper+digits, that’s (26*2+10)^8=2.14E+14 passwords. This number is way out of range even for a PC with 8x 1080 Ti. Those GPUs are only useful in a very small number of corner cases.

mrb 9y ago
2.14e14 is nothing. 8x 1080 Ti can crack that in less than 15 minutes (NTLM, MD4, MD5).
- Const-me 9y ago
  This page says 8x 1080 Ti can do 1.3e10 hashes/sec for NTLM: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... To test 2.14e14 passwords, you need 4.5 hours. Add a single extra character to that password and the time will become too long regardless on your hardware.
  - nitin_flanker 9y ago
    Also, the OP didn't mention the use of symbols. Cracking even a 8 digit password that have symbols in it will become impractical to even consider.
    - lightedman 9y ago
      Process of elimination restricts character and symbol sets, generally, narrowing your set of possible combinations greatly. The best way to crack a password isn't to brute-force it first, it's to first analyze who made the password, and the password system, to narrow down all possibilities before you try brute-forcing. Example; if a person is American, you can pretty much assume they're restricted to the typical US keyboard and its symbols, for 90+% of the population. Very few people know of ALT codes or unicode or even the character map, even in IT. That narrows your symbol subset down dramatically. System for passwords truncates after 12 characters, has a minimum of 8? You already know you don't need to try doing anything with more than 12 characters, and you can limit your password cracking to starting with 8 characters and ignore anything with fewer than that. That eliminates a whole slew of brute-forcing that is required, as you've now narrowed down the password range. All it takes is a little thinking. Man can make it, man can break it, there is simply no exception.
      - algorias 9y ago
        I believe the poster upthread already considered only restricted characters (upper + lower + digits), so the difficulty they stated is what remains after your analysis. > Man can make it, man can break it, there is simply no exception. Nice platitude, but this is simply not true.
        nitin_flanker 9y ago
        Rightly said. Even after we narrow down all the possibilities, there are still some common symbols that usually get used in passwords (%, $, @, etc.)
        lightedman 9y ago
        "Nice platitude, but this is simply not true." You got an example of anything man has made that man has not broken? "I believe the poster upthread already considered only restricted characters (upper + lower + digits), so the difficulty they stated is what remains after your analysis." No it's not, because they didn't think of things like password truncation (which my bank annoyingly does) and various other things. I tested it. It took me almost an hour to crack my chosen mixed-character + symbol 15 character password with a GTX970 implementing the few rules I stated above. Howsecureismypassword.net says it would take a computer 16 BILLION years to crack. My point very firmly stands.
  - mrb 9y ago
    No it says 334.0 GH/s (3.3e11). But they actually do 441.4 GH/s (4.4e11) according to this HN submission using the latest hashcat. I can understand why you were doubtful if you were off by 33x.
nikcub 9y ago
> My GPU was able to try 20GB passwords in a couple of minutes. That was the largest password list I’ve found on the internets. Password matching is the low hanging fruit, I usually run them on a regular server. Where you need the large GPU workloads is in applying rules to these lists and in generating variations. There is also work in generating the rule files themselves. The good rule sets like dive[0] have 1.2M+ rules[1]. Run that again through your 20GB list and you'll see quickly why you need many GPU's :) [0] https://hashcat.net/wiki/doku.php?id=rule_based_attack https://hashcat.net/wiki/doku.php?id=rule_based_attack [1] you don't need that many rules, it is very rapidly diminishing returns after ~60% cracked and thousands of rules.

mrb 9y ago

2.14e14 is nothing. 8x 1080 Ti can crack that in less than 15 minutes (NTLM, MD4, MD5).

Const-me 9y ago
This page says 8x 1080 Ti can do 1.3e10 hashes/sec for NTLM: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... To test 2.14e14 passwords, you need 4.5 hours. Add a single extra character to that password and the time will become too long regardless on your hardware.
- nitin_flanker 9y ago
  Also, the OP didn't mention the use of symbols. Cracking even a 8 digit password that have symbols in it will become impractical to even consider.
  - lightedman 9y ago
    Process of elimination restricts character and symbol sets, generally, narrowing your set of possible combinations greatly. The best way to crack a password isn't to brute-force it first, it's to first analyze who made the password, and the password system, to narrow down all possibilities before you try brute-forcing. Example; if a person is American, you can pretty much assume they're restricted to the typical US keyboard and its symbols, for 90+% of the population. Very few people know of ALT codes or unicode or even the character map, even in IT. That narrows your symbol subset down dramatically. System for passwords truncates after 12 characters, has a minimum of 8? You already know you don't need to try doing anything with more than 12 characters, and you can limit your password cracking to starting with 8 characters and ignore anything with fewer than that. That eliminates a whole slew of brute-forcing that is required, as you've now narrowed down the password range. All it takes is a little thinking. Man can make it, man can break it, there is simply no exception.
    - algorias 9y ago
      I believe the poster upthread already considered only restricted characters (upper + lower + digits), so the difficulty they stated is what remains after your analysis. > Man can make it, man can break it, there is simply no exception. Nice platitude, but this is simply not true.
      - nitin_flanker 9y ago
        Rightly said. Even after we narrow down all the possibilities, there are still some common symbols that usually get used in passwords (%, $, @, etc.)
      - lightedman 9y ago
        "Nice platitude, but this is simply not true." You got an example of anything man has made that man has not broken? "I believe the poster upthread already considered only restricted characters (upper + lower + digits), so the difficulty they stated is what remains after your analysis." No it's not, because they didn't think of things like password truncation (which my bank annoyingly does) and various other things. I tested it. It took me almost an hour to crack my chosen mixed-character + symbol 15 character password with a GTX970 implementing the few rules I stated above. Howsecureismypassword.net says it would take a computer 16 BILLION years to crack. My point very firmly stands.
- mrb 9y ago
  No it says 334.0 GH/s (3.3e11). But they actually do 441.4 GH/s (4.4e11) according to this HN submission using the latest hashcat. I can understand why you were doubtful if you were off by 33x.

nikcub 9y ago

> My GPU was able to try 20GB passwords in a couple of minutes. That was the largest password list I’ve found on the internets. Password matching is the low hanging fruit, I usually run them on a regular server. Where you need the large GPU workloads is in applying rules to these lists and in generating variations. There is also work in generating the rule files themselves. The good rule sets like dive[0] have 1.2M+ rules[1]. Run that again through your 20GB list and you'll see quickly why you need many GPU's :) [0] https://hashcat.net/wiki/doku.php?id=rule_based_attack https://hashcat.net/wiki/doku.php?id=rule_based_attack [1] you don't need that many rules, it is very rapidly diminishing returns after ~60% cracked and thousands of rules.