Slashdot Log In
Using Google To Crack MD5 Passwords
Posted by
kdawson
on Tue Nov 20, 2007 05:19 PM
from the secrets-shared-with-the-world dept.
from the secrets-shared-with-the-world dept.
stern writes "A security researcher at Cambridge was trying to figure out the password used by somebody who had hacked his Web site. He tried running a dictionary through the encryption hash function; no dice. Then he pasted the hacker's encrypted password into Google, and voila — there was his answer. Conclusion? Use no password that any other human being has ever used, or is ever likely to use, for any purpose. I think."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Salt (Score:5, Informative)
Re:Salt (Score:5, Funny)
Parent
Re:Salt (Score:5, Funny)
Parent
Re:RTFA (Score:5, Funny)
Parent
Re:Salt (Score:5, Insightful)
Precomupted dictionaries? Salting breaks it.
Brute force and compare against the whole pw list? Salting breaks it.
Salting is your friend. Long salts don't cost much, but make many attacks completely infeasible. Unix has been using salted passwords since forever. Yet nthash *still* doesn't include a salt.
Parent
Re:Salt (Score:5, Funny)
Parent
Re:Salt (Score:5, Funny)
Need something else to put on those fries? Salt it!
Need to make your friend's drink taste awful? Salt is the way to go.
(Somewhere along the line we left the analogy department
Parent
Re:Salt (Score:5, Funny)
Parent
Re:Salt (Score:5, Insightful)
This is why my passwords are themselves salted hashes. The likelihood of someone else using my passwords is the same as a regular hash collision, I get to use a separate password for each place one is required, and the hashing mechanism and salt are simple enough for me to keep in my head. End result: infinite number of easily generatable and retrievable passwords that look just like a hashed password when decoded.
Parent
MD5 Lookup Site & Names (Score:5, Informative)
He could have discovered this if he had used a database complete with names, something I don't think would have been too difficult for him.
This Google search idea is kind of moot if the user uses some very basic password construction such as what I've commented on before [slashdot.org]. Also, as the blog mentions, this discussion is worthless if WordPress used salting [wikipedia.org] which is related to nonces used in security engineering [wikipedia.org]. I think that stuff has been around for, what about five years now? Wake up WordPress!
5 years? (Score:5, Informative)
Parent
Re:MD5 Lookup Site & Names (Score:5, Funny)
Parent
Re:MD5 Lookup Site & Names (Score:5, Insightful)
I doubt Bruce Schneier himself audited the entire Movable Type codebase, which he uses for his blog. Does that make Schneier "not much of a security researcher"?
Parent
Obligatory (Score:5, Funny)
Re:Obligatory (Score:5, Funny)
Parent
I wouldn't be too alarmed. (Score:5, Informative)
Re:I wouldn't be too alarmed. (Score:5, Funny)
Parent
Re:I wouldn't be too alarmed. (Score:5, Interesting)
Parent
Re:I wouldn't be too alarmed. (Score:5, Interesting)
Oh it's even better than that. It stores your md5 password in a plain text cookie, and if it receives such a cookie, sets an $already_md5 flag to true that's then passed to wp_login() which then just compares it literally against the unsalted md5 entry.
<guinness>Brilliant!</guinness>
Parent
Dark Helmet (Score:5, Funny)
Let me guess (Score:5, Funny)
Re:Let me guess (Score:5, Funny)
Parent
In itself nothing new (Score:5, Insightful)
I am already doing this for telephone calls I cannot place. If it's an institution or a person that is calling because of profession, the chances that the telephone is listed somewhere on a (search engine) accessible web page is *very* large.
on a related note... (Score:5, Interesting)
- I found this file on my computer and I forgot where it came from.
- I downloaded this file but I forget where I got it. It's too big to email so I would like to send a friend a link to the original file.
- I want to see if anyone has taken this pic from my site and posted it elsewhere.
- This download is taking FOREVER. Is anyone else hosting this exact file?
and many, many more. I had this idea years ago and sent it in to them but haven't heard anything since. I don't want any credit**, just implement it and let me know when it's up and running! And the funny thing is, I'm sure Google is already checksumming every file as part of how they do all their magic. All they have to do is post the data!* and, since collisions are possible, it would provide a nice corpus to study collisions, etc. in the real world.
** this isn't an entirely original idea. Linux distros have been posting checksums for years as a way to let users verify that their downloads were not corrupted; as a bonus, I (and I'm sure some others) have done searches of those values to find sites hosting that particular release.
Man, I need to change my password NOW. (Score:5, Funny)