47 ms·

I feel like the real take-away from this article is that MD5 is broken, something we've all known for ages. An application using a memory-hard algorithm like b

• makomk 8y ago
  Yes, that's pretty much the right take-away from this. The whole reason why key stretching techniques like PBKDF2 are so vital is that people simply cannot be expected to remember passwords strong enough to resist brute force at the speed we can achieve these days if they're just hashed with MD5, SHA1, or any of the other cryptographic hashes. That's true whether they're random words, random letters, or any other scheme you can think up.
• jeremysalwen 8y ago
  Yup, also no mention of salting the passwords. The 200 billion md5 hashes per second figure they use matches up nicely with this 8x GTX 1080 system: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... which cracks bcrypt (at a weak security factor) two million times slower. So, that same system would crack a 3 word password at this weak bcrypt setting in about 3 years, and a 4 word password in 50 thousand years.
  • PaulMoore 8y ago
    Salts make no difference here. They do not harden passwords, but make an otherwise deterministic process random to ensure no two inputs result in the same output. Of course, using a slower hash algorith will increase the time required to break it... but we know the majority of sites don't adequately protect passwords. There are 331 breaches on HIBP. 108 used MD5, 43 used SHAx... meaning half of all firms used algorithms which we can break quickly & easily.