4 ms·
when you look properly at the end of the video the root hash starts with $y$ implying its yescrypt more info here https://manpages.debian.org/unstable/libcrypt
by thevania 3y ago
when you look properly at the end of the video the root hash starts with $y$ implying its yescrypt
more info here https://manpages.debian.org/unstable/libcrypt-dev/crypt.5.en.html https://manpages.debian.org/unstable/libcrypt-dev/crypt.5.en...
https://www.openwall.com/yescrypt/ https://www.openwall.com/yescrypt/
once you have the hash you have to use some rainbow tables if they exist for that hash function or bruteforce it
the authors of yescrypt claim: "Technically, yescrypt is the most scalable password hashing scheme so far, providing near-optimal security from offline password cracking across the whole range from kilobytes to terabytes and beyond. "
in any way, this is a local attack, someone / some software on your local machine would need to execute it so i am not overly stressed, password hashes leak all the time from all different sources
yet, it does worry me because my AMD stock is dropping on value because of this today :D
- CodesInChaos 3y agoRainbow tables are only applicable to unsalted hashes (or possibly to ones with tiny salts). They are so rarely applicable, that I wouldn't even bother mentioning them. On that list, NT is the only completely unsalted hash, plus DEScrypt and its variants might still be susceptible with its 12 bit salt. Like all decent password hashes, yescrypt is salted.
- deleted 3y ago[deleted]
- nneonneo 3y agofwiw, yescrypt uses a salt so it will not be vulnerable to rainbow tables, and it is a slow hash so it won’t be that easy to bruteforce. A good strong password with a good hash function should remain secure even if the hash leaks.