3 ms·
The difference between hashing and encrypting that I did not find quite spelled out enough in the article is that with leaked hashes there is a risk of cracking
by zokier 6y ago
The difference between hashing and encrypting that I did not find quite spelled out enough in the article is that with leaked hashes there is a risk of cracking proportional to the password strength. High entropy passwords will not get cracked even if they are hashed with the MD5 which pretty much represents worst case scenario[1]. With encryption, it is very much all or nothing scenario; if the database gets cracked then all of the passwords get revealed.
[1] Napkin math: Single Titan RTX does some 65GH/s of MD5, so if you have 80bit password it would take in the order of 2^80/65e9 seconds = 500e3 gpu-years to crack
- 10000truths 6y agoIf you have a random 80 bit password, yes. But passwords are the farthest thing from random. Even high entropy passwords from a password generator will only use the printable ASCII character set, which reduces the number of possible values of a byte from 256 to 95. An 80 bit password from a conventional random password generator would have an effective entropy of (80/8)*log2(95) ~ 66 bits, which would take about 30 GPU years.
- moron4hire 6y ago80-bit password is not the same thing as 10-ASCII-characters password. The reduced alphabet space of only using printable characters is taken into account when figuring the bit-edness of a password.