4 ms·

Yes, although some of them (especially for older accounts, which probably haven't been logged into in a while) appear to be unsalted MD5. That's not unusual: it

• arethuza 15y ago
  If all you can see is the MD5 hash value, how can you tell that it was unsalted?
  • nbpoole 15y ago
    The crypt'ed MD5 hashes have a special prefix which indicates that's what they are. For the other hashes, the fact that there's no nonce or other value stored alongside them was a strong hint (although it doesn't rule out a site-wide nonce). However, I confirmed my suspicion by Googling one of the hashes: it was on a list of unsalted hashes that had been brute forced (unrelated to this, the password was fairly common).
  • catch23 15y ago
    According to: http://php.net/manual/en/function.crypt.php http://php.net/manual/en/function.crypt.php CRYPT_MD5 - MD5 hashing with a twelve character salt starting with $1$ So the hashes you see beginning with $1$ are probably salted.
    • dekz 15y ago
      Aren't the salts stored within the hash $type$salt$hash
      • arethuza 15y ago
        What is the point of storing the salt with the hashed value?
        • dekz 15y ago
          Attempting to hide it somewhere else doesn't really help when your whole system is compromised. Salting+hashing isn't the answer to 'how to store passwords so no hacker can ever get them', it's the answer to 'how to store passwords so it would take a very very long time and a lot of resources for a hacker to ever get them'. It's designed like this to also allow easy authentication of users by simply performing the same process used originally. So the only real thing storing the salt somewhere else would accomplish is greater latency for authentication.
          • arethuza 15y ago
            Sorry I should have rephrased that, I really meant "isn't using any kind of salt at all deprecated"? Honest... :-) http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/ [Edit: I meant your typical web application mucking about with salts, not their use within properly thought out things like bcrypt]
            • dekz 15y ago
              Bcrypt uses salts. But your link is correct, attempting to roll your own crypto is getting all these companies caught out and bad crypto use is causing their users to suffer. I for one would now not feel safe using a password for more than one website.
            • catch23 15y ago
              I believe the standard library for bcrypt in ruby also uses salts, it just stores the salt with the hashed password data. Salts will prevent the typical rainbow table attack where you have precomputed hashes for a large number of attempts. Salts won't prevent brute force, but bcrypt will make it so that brute force takes too long for a single given user.
• jjm 15y ago
  And also: http://en.wikipedia.org/wiki/Password_cracking http://en.wikipedia.org/wiki/Password_cracking " Graphics processors can speed up password cracking by a factor of 50 to 100 over general purpose computers. As of 2011, commercial products are available that claim the ability to test up to 2,800,000,000 passwords a second on a standard desktop computer using a high-end graphics processor. [3] Such a device can crack a 10 letter single-case password in one day. Note that the work can be distributed over many computers for an additional speedup proportional to the number of available computers with comparable GPUs."
  • cabr1to 15y ago
    ... and considering the audience and the amount of free GPU hardware out there, it's not out of the question that someone might try and turn all that parallel computing muscle toward more nefarious purposes. Not that this all seems necessary, of course, given the woefully insecure state of MtGox these days...