7 ms·

MD5 is not that weak, it's just fast, so you have to use a few rounds of it. The preimage vulnerability reduced the search space from 128 bits to 124 [1], which

MD5 is not that weak, it's just fast, so you have to use a few rounds of it. The preimage vulnerability reduced the search space from 128 bits to 124 [1], which is still extremely secure. People who claim it's broken are probably thinking about the collision vulnerability, which doesn't help you at all to recover the password from a hash. [1]: https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability If you think I'm wrong, I will gladly admit so, just tell me what the $password is here: if (md5(md5($password)) == 'c9876599e5e54aa12962ae1fe7b0f752') ...

astrodust 9y ago
The problem is not that hard passwords are easy to crack, it's that easy passwords are stupid easy to crack. An attacker doesn't care about your password so much as they care about getting 50-80% of the passwords on the system, the majority of which are going to be "password123" or some other garbage you can find in a dictionary attack. If you use something like Bcrypt or Scrypt then running your dictionary cracker becomes a real ordeal, it will take a long time to grind through those entries and find matches. With MD5 it's a joke, you can do most of the common ones in seconds and the trickier variants within hours. Hashcat (https://hashcat.net/hashcat/ https://hashcat.net/hashcat/) can and will make short work of your double MD5 nonsense. Additionally, if I can find a bit of text that hashes the same I don't care what the original password was. I have a key that works.
- olegkikin 9y ago
  That's why I mentioned "a few rounds of it". Use 1000 if you're paranoid, you can make it as computationally complex as BCrypt. And, of course, you should use salts. Good luck breaking that. You couldn't even break my double MD5. Another thing you should do is not allow common or short passwords. That includes "password123". That alone will immediately elevate your security. > Additionally, if I can find a bit of text that hashes the same I don't care what the original password was. I have a key that works And you clearly don't understand how the collusion vulnerability works. You can't create one with a given hash. You carefully craft two documents that hash to the same hash, which you don't know in advance. Again, you can prove me wrong by doing just that to the hash in the code snippet.
  - tedunangst 9y ago
    1000 rounds of MD5 is nowhere close to enough. Don't use MD5 for password hashing.
  - stouset 9y ago
    FFS, stop making cryptographic recommendations to others when you don't have expertise in this area. Cryptographers nowadays are recommending PKBDF2 (essentially iterated hashing with the hash algorithm of your choice) with at least 100,000 rounds. And it's considered to by far the weakest of "modern" password hashing approaches, behind bcrypt, scrypt, and Argon2 (in that order). Your double-MD5 is garbage, and nobody is going to bother wasting their time breaking it because it's a bullshit challenge. If you used a strong, unique password, you've missed the point, because users in the real world don't. If you used a weak password, we have a few billion points of empirical data that contradict you, so why bother installing hashcat and mucking about with password cracking rules when anyone paying attention for the past ten years knows what the outcome is going to be?
    - olegkikin 9y ago
      So use 100,000 rounds, use 1 million rounds, whatever amount makes you happy. You guys can't even break 2 rounds. I actually do use PKBDF2 / Bcrypt in real world projects. My original comment was entirely about MD5 not really being broken, just too fast. > because users in the real world don't. No, you missed the point, and I wrote about it specifically. You should not allow weak / common / short passwords.
      - stouset 9y ago
        MD5 is broken for passwords because it is too fast. Sure, if you use PBKDF2-MD5 with a random salt and 100k iterations you're going to be fine but that's not what anyone in this thread, including you, has been talking about. You started off saying MD5 is fine, then backed off to saying it's fine with a salt, then fine with two rounds, then suggested 1,000 is okay, now we're at 100,000. At what point do you stop making excuses and acknowledge that your original advice was garbage, and backpedaling repeatedly is not helping your case? Further, it is impossible to categorically prevent weak passwords. You can impose length restrictions. You can disallow common passwords. You can require special characters. But people's ability to come up with weak, pattern-based passwords fundamentally outperforms our ability to stop them, and at some point restrictions become so burdensome that people stop signing up for your app altogether. "Just block weak passwords" is ridiculous on its face and you either know it and are arguing simply to save face, or you don't know it and are infuriatingly overconfident for your level of incompetence. I'm past the point of caring which.
idlewords 9y ago
I don't know if you care, but "prove me wrong by breaking this" is a red flag for crackpottery in crypto, and people will set the bozo bit on you.
- stouset 9y ago
  He doesn't care because he's "right".
thehardsphere 9y ago
Did you previously work for Yahoo?

astrodust 9y ago

The problem is not that hard passwords are easy to crack, it's that easy passwords are stupid easy to crack. An attacker doesn't care about your password so much as they care about getting 50-80% of the passwords on the system, the majority of which are going to be "password123" or some other garbage you can find in a dictionary attack. If you use something like Bcrypt or Scrypt then running your dictionary cracker becomes a real ordeal, it will take a long time to grind through those entries and find matches. With MD5 it's a joke, you can do most of the common ones in seconds and the trickier variants within hours. Hashcat (https://hashcat.net/hashcat/ https://hashcat.net/hashcat/) can and will make short work of your double MD5 nonsense. Additionally, if I can find a bit of text that hashes the same I don't care what the original password was. I have a key that works.

olegkikin 9y ago
That's why I mentioned "a few rounds of it". Use 1000 if you're paranoid, you can make it as computationally complex as BCrypt. And, of course, you should use salts. Good luck breaking that. You couldn't even break my double MD5. Another thing you should do is not allow common or short passwords. That includes "password123". That alone will immediately elevate your security. > Additionally, if I can find a bit of text that hashes the same I don't care what the original password was. I have a key that works And you clearly don't understand how the collusion vulnerability works. You can't create one with a given hash. You carefully craft two documents that hash to the same hash, which you don't know in advance. Again, you can prove me wrong by doing just that to the hash in the code snippet.
- tedunangst 9y ago
  1000 rounds of MD5 is nowhere close to enough. Don't use MD5 for password hashing.
- stouset 9y ago
  FFS, stop making cryptographic recommendations to others when you don't have expertise in this area. Cryptographers nowadays are recommending PKBDF2 (essentially iterated hashing with the hash algorithm of your choice) with at least 100,000 rounds. And it's considered to by far the weakest of "modern" password hashing approaches, behind bcrypt, scrypt, and Argon2 (in that order). Your double-MD5 is garbage, and nobody is going to bother wasting their time breaking it because it's a bullshit challenge. If you used a strong, unique password, you've missed the point, because users in the real world don't. If you used a weak password, we have a few billion points of empirical data that contradict you, so why bother installing hashcat and mucking about with password cracking rules when anyone paying attention for the past ten years knows what the outcome is going to be?
  - olegkikin 9y ago
    So use 100,000 rounds, use 1 million rounds, whatever amount makes you happy. You guys can't even break 2 rounds. I actually do use PKBDF2 / Bcrypt in real world projects. My original comment was entirely about MD5 not really being broken, just too fast. > because users in the real world don't. No, you missed the point, and I wrote about it specifically. You should not allow weak / common / short passwords.
    - stouset 9y ago
      MD5 is broken for passwords because it is too fast. Sure, if you use PBKDF2-MD5 with a random salt and 100k iterations you're going to be fine but that's not what anyone in this thread, including you, has been talking about. You started off saying MD5 is fine, then backed off to saying it's fine with a salt, then fine with two rounds, then suggested 1,000 is okay, now we're at 100,000. At what point do you stop making excuses and acknowledge that your original advice was garbage, and backpedaling repeatedly is not helping your case? Further, it is impossible to categorically prevent weak passwords. You can impose length restrictions. You can disallow common passwords. You can require special characters. But people's ability to come up with weak, pattern-based passwords fundamentally outperforms our ability to stop them, and at some point restrictions become so burdensome that people stop signing up for your app altogether. "Just block weak passwords" is ridiculous on its face and you either know it and are arguing simply to save face, or you don't know it and are infuriatingly overconfident for your level of incompetence. I'm past the point of caring which.

idlewords 9y ago

I don't know if you care, but "prove me wrong by breaking this" is a red flag for crackpottery in crypto, and people will set the bozo bit on you.

stouset 9y ago
He doesn't care because he's "right".

thehardsphere 9y ago

Did you previously work for Yahoo?