3 ms·
Yup, also no mention of salting the passwords. The 200 billion md5 hashes per second figure they use matches up nicely with this 8x GTX 1080 system: https://gi
by jeremysalwen 8y ago
Yup, also no mention of salting the passwords.
The 200 billion md5 hashes per second figure they use matches up nicely with this 8x GTX 1080 system: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... which cracks bcrypt (at a weak security factor) two million times slower.
So, that same system would crack a 3 word password at this weak bcrypt setting in about 3 years, and a 4 word password in 50 thousand years.
- PaulMoore 8y agoSalts make no difference here. They do not harden passwords, but make an otherwise deterministic process random to ensure no two inputs result in the same output. Of course, using a slower hash algorith will increase the time required to break it... but we know the majority of sites don't adequately protect passwords. There are 331 breaches on HIBP. 108 used MD5, 43 used SHAx... meaning half of all firms used algorithms which we can break quickly & easily.