3 ms·

I thought they had them hashed and salted, but the crackers are using rainbow tables and brute force to crack them?

• deleted 16y ago
  [deleted]
  • gthank 16y ago
    No, they weren't. According to the "Release Notes", they were using a DES-based crypt scheme. Read up on tptacek's (http://news.ycombinator.com/user?id=tptacek http://news.ycombinator.com/user?id=tptacek) comments on the matter.
    • pietrofmaggi 16y ago
      Yes, as you told, I was writing from my memory and I remembered having read DES encryption with password in source somewhere. But It seems it was a DES based hashing: http://www.duosecurity.com/blog/entry/brief_analysis_of_the_gawker_password_dump http://www.duosecurity.com/blog/entry/brief_analysis_of_the_... [edit] deleted the parent post because I could not find the article I remembered (which was probably wrong anyways).
  • tedunangst 16y ago
    Do you have a reference for that? Everything I've read (not really authoritative) indicated they were using the standard crypt interface, which does use DES, but is a lot closer to salted hash then encrypted. I can see the issue getting confused either way (people see DES, don't know what to think), but using crypt seems a lot more likely.
• Xk 16y ago
  Brute force? Yes. Rainbow tables? No. That's the purpose of a salt. The table needs to be several orders of magnitude bigger.