Re:Yahoo discloses hack of 1B accounts
by JonDav on Wednesday December 14, 2016 @06:14PM
(#13180658)
Pretty much even if you choose a high entropy password like say:
the MD5 algorithm can be broken using various techniques like collisions, unsalted I believe means that their database would accept the hashes the third party has. End result is they should have migrated away from MD5 after it was declared unsafe.
[ Parent
| on HN ]
Re:Yahoo discloses hack of 1B accounts
by danielweber on Wednesday December 14, 2016 @09:15PM
(#13181780)
No it can't.
Two principles here:
1. If your password is very very good (a Diceware password would suffice), then any method of storing passwords that is better than storing them in plaintext will stop someone from brute forcing it.
2. If your password is very bad, then even an excellent password hashing algorithm will not save you.
"Just use bcrypt" is meant to save people who are in the middle.
No, a collision attack would not give you the plaintext from a hash. A first preimage attack would do that, but no computable first (or second) preimage attacks against md5 have been found.
https://stackoverflow.com/questions/822638/does-any-publishe...