4 ms·

Is the password ncc1701e? I just googled it and found https://hashtoolkit.com/decrypt-sha1-hash/b85ffa7dae2cbed04e7d3335f6ebc43c8a5764dd https://hashtoolkit.co

Is the password ncc1701e? I just googled it and found https://hashtoolkit.com/decrypt-sha1-hash/b85ffa7dae2cbed04e7d3335f6ebc43c8a5764dd https://hashtoolkit.com/decrypt-sha1-hash/b85ffa7dae2cbed04e... along with other results.

maccard 5y ago
It is! I guess using a password from Google isn't the best idea, and kind of defeated the point of what I wanted to ask (if your password isn't already hashed online how long does it actually take to break a sha1 hash), but definitely proves the point. Can I try again? Sha1 e7b7cdf949007abe7e8a190ba8eae56c60018c1f
- Behemoth66 5y ago
  Couldn’t find it in 1.4 Trillion combinations. Used rockyou.txt with dive.rule. Took me 6 minutes to try all 1.4 trillion passwords. So either you have a strong password or I messed something up. What is it? In theory if your password was weak enough to be on this list it would take on average 3 minutes to break it on a GTX 1080.
  - maccard 5y ago
    Thanks for trying! This somewhat supports what I'm suggesting - because that password hasn't been leaked by being posted in plaintext as a verified password, it's not available as a lookup, therefore it doesn't matter whether they used bcrypt, sha1 or md5, or even just pgp encrypted it, the password is likely "secure".
    - Behemoth66 5y ago
      It depends. It doesn’t have to strictly be a leaked password. If it’s similar to a leaked password then the permutation rule-set will catch it. Anything under 9 characters I can brute force in minutes. 9 character passwords would take me 9 hours. Obviously if someone has a nest of the latest GPUs then they could go a lot faster. But yes if your password is uwv&6qu_brusb618_$@618jg then it doesn’t really matter how you hash it.
      - maccard 5y ago
        The reason I didn't give any more information on the password above is because you don't have any extra information on a dump of hashes from a twitch database either. If a password is only feasibly brute forceable for a specific algorithm by reducing the search space by many orders of magnitude, it kind of shows that there's not really any risk even if the passwords are unsalted for a person who hasn't reused a password.
        thaumasiotes 5y ago
        > it kind of shows that there's not really any risk even if the passwords are unsalted for a person who hasn't reused a password. No, it doesn't. You could reuse uwv&6qu_brusb618_$@618jg everywhere and it wouldn't get cracked. If the plaintext password leaked, then you'd be in more trouble. What matters is whether your password is easy to guess, not whether you've reused it. If you have all unique passwords, they can still all be trivial to crack.
    - ghostway-chess 5y ago
      Well. Sha1 is not _that_ hard to break. It's a solved algorithm
      - astrange 5y ago
        That's for generating collisions, not preimage resistance. It's not particularly easy to reverse.
- shkkmo 5y ago
  The point of the salt isn't that it makes it take longer to break any one password. What it does is prevent you from re-using the rainbow table you generate breaking one password when you break the next one. Sha1 is not a very secure/expensive hashing algorithm and thus does make it significantly cheaper to break even with a unique salt.
  - maccard 5y ago
    > Sha1 is not a very secure/expensive hashing algorithm and thus does make it significantly cheaper to break even with a unique salt. Ok, so how long does it take to break the hash I've provided if it's not very secure?
    - shkkmo 5y ago
      It's not so much "how long does it take" as it is "how much does it cost" and the answer to that really depends on what sort of compute infrastructure you have access to. Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. Preventing the re-use of that computational effort on additional users is why unique salts are important.
      - maccard 5y ago
        > It's not so much "how long does it take" as it is "how much does it cost" So the answer is "It's too expensive to figure out in practice, unless you're being explicitly targetted by someone with nation state level credentials?", i.e. it's pretty much fine? > Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. But by the sounds of it, SHA1 is more than enough (given that nobody here is willing to brute force the hash I shared above?) > Preventing the re-use of that computational effort on additional users is why unique salts are important. The person who "cracked" my first hash found it in a list of passwords which was actually gotten from a plain text dump 15 years ago. That wasn't found by reversing a hash, so the compute wasn't reused. You are right that once it's cracked, it's cracked and that's that, but if your password _isn't_ cracked it's moot whether it's hashed with SHA1 or something more secure, as per above?

maccard 5y ago

It is! I guess using a password from Google isn't the best idea, and kind of defeated the point of what I wanted to ask (if your password isn't already hashed online how long does it actually take to break a sha1 hash), but definitely proves the point. Can I try again? Sha1 e7b7cdf949007abe7e8a190ba8eae56c60018c1f

Behemoth66 5y ago
Couldn’t find it in 1.4 Trillion combinations. Used rockyou.txt with dive.rule. Took me 6 minutes to try all 1.4 trillion passwords. So either you have a strong password or I messed something up. What is it? In theory if your password was weak enough to be on this list it would take on average 3 minutes to break it on a GTX 1080.
- maccard 5y ago
  Thanks for trying! This somewhat supports what I'm suggesting - because that password hasn't been leaked by being posted in plaintext as a verified password, it's not available as a lookup, therefore it doesn't matter whether they used bcrypt, sha1 or md5, or even just pgp encrypted it, the password is likely "secure".
  - Behemoth66 5y ago
    It depends. It doesn’t have to strictly be a leaked password. If it’s similar to a leaked password then the permutation rule-set will catch it. Anything under 9 characters I can brute force in minutes. 9 character passwords would take me 9 hours. Obviously if someone has a nest of the latest GPUs then they could go a lot faster. But yes if your password is uwv&6qu_brusb618_$@618jg then it doesn’t really matter how you hash it.
    - maccard 5y ago
      The reason I didn't give any more information on the password above is because you don't have any extra information on a dump of hashes from a twitch database either. If a password is only feasibly brute forceable for a specific algorithm by reducing the search space by many orders of magnitude, it kind of shows that there's not really any risk even if the passwords are unsalted for a person who hasn't reused a password.
      - thaumasiotes 5y ago
        > it kind of shows that there's not really any risk even if the passwords are unsalted for a person who hasn't reused a password. No, it doesn't. You could reuse uwv&6qu_brusb618_$@618jg everywhere and it wouldn't get cracked. If the plaintext password leaked, then you'd be in more trouble. What matters is whether your password is easy to guess, not whether you've reused it. If you have all unique passwords, they can still all be trivial to crack.
  - ghostway-chess 5y ago
    Well. Sha1 is not _that_ hard to break. It's a solved algorithm
    - astrange 5y ago
      That's for generating collisions, not preimage resistance. It's not particularly easy to reverse.
shkkmo 5y ago
The point of the salt isn't that it makes it take longer to break any one password. What it does is prevent you from re-using the rainbow table you generate breaking one password when you break the next one. Sha1 is not a very secure/expensive hashing algorithm and thus does make it significantly cheaper to break even with a unique salt.
- maccard 5y ago
  > Sha1 is not a very secure/expensive hashing algorithm and thus does make it significantly cheaper to break even with a unique salt. Ok, so how long does it take to break the hash I've provided if it's not very secure?
  - shkkmo 5y ago
    It's not so much "how long does it take" as it is "how much does it cost" and the answer to that really depends on what sort of compute infrastructure you have access to. Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. Preventing the re-use of that computational effort on additional users is why unique salts are important.
    - maccard 5y ago
      > It's not so much "how long does it take" as it is "how much does it cost" So the answer is "It's too expensive to figure out in practice, unless you're being explicitly targetted by someone with nation state level credentials?", i.e. it's pretty much fine? > Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. But by the sounds of it, SHA1 is more than enough (given that nobody here is willing to brute force the hash I shared above?) > Preventing the re-use of that computational effort on additional users is why unique salts are important. The person who "cracked" my first hash found it in a list of passwords which was actually gotten from a plain text dump 15 years ago. That wasn't found by reversing a hash, so the compute wasn't reused. You are right that once it's cracked, it's cracked and that's that, but if your password _isn't_ cracked it's moot whether it's hashed with SHA1 or something more secure, as per above?