4 ms·
I hope they used something sensible like bcrypt for encryption instead of MD5 which is too easy to crack these days.
by mukundmr 13y ago
I hope they used something sensible like bcrypt for encryption instead of MD5 which is too easy to crack these days.
- RossM 13y agoAs far as I remember they were running vBulletin, which uses salted md5. http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/386779-what-cryptographic-hash-function-is-vbulletin-using-for-user-passwords-protection http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4...
- kachnuv_ocasek 13y agoIt's not encryption, it's hashing. Also, I don't see how MD5 is easy to crack.
- codygman 13y agoPost an md5 hash of your password and you'll see ;)
- lukashed 13y agoThe easiest and fastest way is to google it.
- chmodd 13y agoMD5 is so fast on GPUs, you can do some pretty ridiculous dictionary attacks in a matter of minutes (like trying every combination of words that has ever been written in a book or posted online - using google's n-gram corpus for example). Then you have plenty of time to try letter substitutions (3 for e), combinations such as word + number + word, etc. This doesn't apply of course, if your password is a long string of random characters.
- pkolaczk 13y agoUsually it is the password itself that is attacked, not the hashing algorithm. Many people use weak passwords and it is not that hard to use dictionary attacks against them.
- riquito 13y agoDictionary attacks against salted passwords hashed with something like bcrypt take way more time, weak password or not (and yet a weak password is by definition weak)