2 ms·
No hash is impossible to reverse but I think the strength of these systems is that the final password isn't something you need to remember. It can be as long an
by rowanseymour 14y ago
No hash is impossible to reverse but I think the strength of these systems is that the final password isn't something you need to remember. It can be as long and as complex as the website allows. Even weak hash functions like SHA-1 are unrealistic to reverse when the search space is big enough, i.e. enough characters
- dullcrisp 14y agoWell, the relevant search space when reversing a hash is the space of original passwords, and you do have to remember your master password. The attack to worry about with these systems is a website taking your generated password and maliciously reversing it to reveal your master password, not that someone will steal your hashed password from a database where it'll have been hashed again and stored securely, and then reverse it twice to reveal your original master password. Their FAQ seems to say that they salt with other data before hashing, so they should at least be safe from precomputed lookup tables. I don't know how feasible it'd be to crack a hashed, salted password, but they'd probably be better off using blowfish or one of the other algorithms from the "Storing Passwords Securely" article which is now on the front page [1]. And I'm not sure why they mention using l33t-speak to protect your password from being reversed. That's just bizarre. The information on their website makes me worry that they may not know what they're doing, though maybe I'm just misinterpreting it. [1] http://throwingfire.com/storing-passwords-securely/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+throwingfire+%28Throwing+Fire%29#notpasswordhashes http://throwingfire.com/storing-passwords-securely/?utm_sour...