3 ms·
The purpose of the salt is to invalidate rainbow tables. With salt, the only way to reverse is to compute all combinations. With advances in GPU, it has become
by irahul 13y ago
The purpose of the salt is to invalidate rainbow tables. With salt, the only way to reverse is to compute all combinations. With advances in GPU, it has become easier for some hash functions, but it easnt' easy to reverse by any measure.
What are these sites which will crack the passwords in no time? Try reversing this:
38b2cf16f7be6a1b33097084bed6a4b0:lsdjfldsjlfds
- deleted 13y ago[deleted]
- michaelt 13y agooclhashcat-plus [1] claims to perform 6.9 billion MD5 hashes per second on an AMD hd6990 ($900 from Amazon). Assuming the password is eight lower case letters, you can try them all in (26^8)/(6.9 billion) = 30 seconds. Even if the password is eight alphanumeric digits, you can try them all in ((26+26+10)^8)/(6.9 billion) = 8.7 hours. Now admittedly, many users will have more than 8 characters in their passwords, and 8 hours to crack a single account isn't that bad I mean it could be a lot worse, and it's only a forum so no exactly critical infrastructure. However, by the standards of security systems (where we're used to hearing that brute force attacks will take longer than the age of the universe) MD5 is pretty weak. [1] http://hashcat.net/oclhashcat-plus/ http://hashcat.net/oclhashcat-plus/
- elchief 13y agoit's asdfasdf
- irahul 13y agoUmm...no. In [17]: '38b2cf16f7be6a1b33097084bed6a4b0' == hashlib.md5('lsdjfldsjlfds' + 'asdfasdf').hexdigest() Out[17]: False