2 ms·

no, it's not easy to reverse. though if the password was a common one or occurs in a dictionary, it is easier to reverse. and no, they cannot be cracked in 'no

no, it's not easy to reverse. though if the password was a common one or occurs in a dictionary, it is easier to reverse. and no, they cannot be cracked in 'no time'.

bigiain 13y ago
If by "no time", you mean minutes or hours on a typical laptop - hashcat will rip through vbulletin hashes almost as fast as to goes through plain MD5. A journalist[1] got 45% of a list of 17,000 MD5 hashed passwords on his MacBook Air (just CPU hashing no GPU) - in 90 seconds. It's entirely justifiable to expect vbulletin hashes to fall no slower than twice that time. Even using random passwords - which means "non-dictionary words (including guessable letter/symbol substitution and leading/trailing digits)" - you still need to be aware of the abilities of modern password cracking tools. Hashcat with a modern gaming video card can do almost 7billion MD5 hashes per second, which'll search the entire 7char password space in something like 90- seconds - or the entire 9char password space in under 9 days. 11 characters gets you up to a _probably_ acceptable 194 years - against a single GPU attacker, the hashcat code will run on 128GPUs at once, which drops that to only ~18months against a well funded attacker (probably "criminal enterprise" level well funded, well short of "nation state" level). With the Apple password breach - you'd be foolish to not assume criminals could muster hundreds of GPUs to crack passwords that'd give them working iTunes accounts (you give me a couple of tens of thousands of active credit card linked iTunes accounts, and I could think of many ways to turn that into many hundreds of thousands of dollars of revenue for some unscrupulous app developer.) I'm hoping Apples passwords were more securely hashed than salted MD5, but if you were using a less than 10 char password, I'd be changing it immedialtely. Even less that 12 chars might not be safe in a 12 month timeframe... But you aren't going to remember 11char random passwords anyway, so use a tool (1Password/Lastpass/Keypass/etc) and then there's no point _not_ using 16 or 20 or 25char or longer passwords. Anything less than 9 random chars pretty much _can_ be cracked "in no time" - any valuable passwords less than 12 chars should be considered "weak". 1. http://arstechnica.com/security/2013/03/how-i-became-a-password-cracker/ http://arstechnica.com/security/2013/03/how-i-became-a-passw...

no, it's not easy to reverse. though if the password was a common one or occurs in a dictionary, it is easier to reverse. and no, they cannot be cracked in 'no time'.

bigiain 13y ago

If by "no time", you mean minutes or hours on a typical laptop - hashcat will rip through vbulletin hashes almost as fast as to goes through plain MD5. A journalist[1] got 45% of a list of 17,000 MD5 hashed passwords on his MacBook Air (just CPU hashing no GPU) - in 90 seconds. It's entirely justifiable to expect vbulletin hashes to fall no slower than twice that time. Even using random passwords - which means "non-dictionary words (including guessable letter/symbol substitution and leading/trailing digits)" - you still need to be aware of the abilities of modern password cracking tools. Hashcat with a modern gaming video card can do almost 7billion MD5 hashes per second, which'll search the entire 7char password space in something like 90- seconds - or the entire 9char password space in under 9 days. 11 characters gets you up to a _probably_ acceptable 194 years - against a single GPU attacker, the hashcat code will run on 128GPUs at once, which drops that to only ~18months against a well funded attacker (probably "criminal enterprise" level well funded, well short of "nation state" level). With the Apple password breach - you'd be foolish to not assume criminals could muster hundreds of GPUs to crack passwords that'd give them working iTunes accounts (you give me a couple of tens of thousands of active credit card linked iTunes accounts, and I could think of many ways to turn that into many hundreds of thousands of dollars of revenue for some unscrupulous app developer.) I'm hoping Apples passwords were more securely hashed than salted MD5, but if you were using a less than 10 char password, I'd be changing it immedialtely. Even less that 12 chars might not be safe in a 12 month timeframe... But you aren't going to remember 11char random passwords anyway, so use a tool (1Password/Lastpass/Keypass/etc) and then there's no point _not_ using 16 or 20 or 25char or longer passwords. Anything less than 9 random chars pretty much _can_ be cracked "in no time" - any valuable passwords less than 12 chars should be considered "weak". 1. http://arstechnica.com/security/2013/03/how-i-became-a-password-cracker/ http://arstechnica.com/security/2013/03/how-i-became-a-passw...