4 ms·
How did you test these? Are you attacking a "site" (as in spoofing passwords till you get lucky) or actually cracking known hashes. Im assuming the latter (be
by ErrantX 17y ago
How did you test these?
Are you attacking a "site" (as in spoofing passwords till you get lucky) or actually cracking known hashes.
Im assuming the latter (because of the length of time). In which case you could add some straight cracking stats into the mix as well just to emphasis the point.
For example you can generate a Sha1, 5 character rainbow table (which holds all the hashed passwords for a particular keyspace) for the lowercase charset in 13minutes.
And then use it to crack hashes in under 1 second. :)
Upper/Lower 5 chars can be attacked the same way with 40 minuts table generation and, again, under a second to crack.
- aarongough 17y agoThe idea is simply to illustrate the sorts of time involved in guessing someone's password using a brute force attack. If I were attacking hashes then rainbow tables would definitely be my main worry! In this case the main worry is websites (email, banking, etc...) that don't implement rate limiting on their login forms and therefore allow people to make targeted attacks with fairly simple hardware. Because this is out out of the user's control it's very worthwhile choosing a difficult password...