3 ms·
Look up benchmarks for cracking MD5 hashes. You can crack an MD5 hash of an average length password (and StockX only requires an 8 character password), even wit
by txcwpalpha 7y ago
Look up benchmarks for cracking MD5 hashes. You can crack an MD5 hash of an average length password (and StockX only requires an 8 character password), even with a salt, within seconds with a single consumer grade GPU. A hacker group with any serious setup for hash cracking has almost certainly already cracked most, if not all, of these hashes.
- ryanlol 7y agoUnless you presume that you know the salt your comment is utter nonsense. The fact that the article says “believed to be” strongly suggests that things are not as simple as they’re “believed to be”, because if the passwords were easy to crack that’d be trivial to prove.
- thenewnewguy 7y agoIf the hash has been leaked then why is there reason to believe the salt _hasn't_ been leaked?
- deleted 7y ago[deleted]
- eterm 7y agoIf the passwords have leaked it's safe to assume the salts have, typically they're stored side by side.
- alasdair_ 7y ago>Unless you presume that you know the salt your comment is utter nonsense. Usually the attacker will also know the salts in a breach of this type, unless the company did something clever with the salts (doubtful since they used MD5).
- ryanlol 7y agoThe fact that the article says “believed to be” strongly suggests that things are not as simple as they’re “believed to be”, because if the passwords were easy to crack that’d be trivial to prove. We don’t know how the passwords are hashed. All we have is a journo guessing.
- deleted 7y ago[deleted]
- xwdv 7y agoShow me the benchmarks.
- dehrmann 7y agohttps://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... Looking at phpass (one of the md5 algorithms), a high-end GPU can do 7M hashes per sec.
- blondin 7y agonowhere in these benchmarks anyone said the MD5 were salted. am i reading it wrong?
- deleted 7y ago[deleted]
- thenewnewguy 7y agoUnless you're operating under the (likely incorrect) assumption that the salts aren't leaked than salting the password doesn't matter for attacking a single user - it just means you can't reuse your results for other users.
- txcwpalpha 7y agoIf StockX was using phpass (which is a KDF that uses MD5 as a base but adds multiple permutations on top), it is quite a bit safer (but still not recommended and these hashes should be considered to be compromised). The bigger issue is if they were actually using raw MD5 (which is sadly quite common), which is benchmarked at 25 billion (with a B) hashes per sec per GPU.