3 ms·
" Choosing a random password is actually useful in this case, because even if the computer correctly finds the right key for de-hashing, it doesn't recognize yo
by VexXtreme 14y ago
" Choosing a random password is actually useful in this case, because even if the computer correctly finds the right key for de-hashing, it doesn't recognize your password as 'de-hashed' and just passes right over it."
That's assuming someone is trying to brute force a system 'from the outside', without having access to the list of password hashes for the system. In reality such attempts rarely if ever happen and they are easily defeated by using rate limiting and other techniques.
The problem arises when the attacker has a list of hashed password and is running checks against that list. In those cases, the fact that a password is random won't do any good as the program knows which password hash it is trying to crack.
Furthermore, there is no "de-hashing". Password cracking software is actually hashing commonly used words, letter combinations and/or even random characters, and comparing the output of the hashing operation with the password hash that it is trying to crack. Cryptographic hash functions are unidirectional and cannot be reversed, you can only try to hash raw data and hope to produce a hash which matches the hash you're trying to "reverse".
- demallien 14y agoYou're talking about rainbow tables. They aren't used very much anymore, since the salting of hashes has become commonplace. As for your idea that hash functions can't be reversed, not so much. They can't be easily reversed, but that's not the same thing. In reality, brute forcing is pretty much the only viable attack left now that salting is commonplace. Still, if you have managed to get your hands on the password table, you can brute force without having to worry about rate limiting etc.