News for hackers. Stuff that matters.
Re:I mean, why not tell everyone our password hashes? by throwaway2016a on Friday July 14, 2017 @09:48PM (#14774591)
In reality while that would be really easy to crack (measured in minutes as others pointed out).

However, any possible password with a standard printable ASCII character set will typically be found in Rainbow tables up to 10 characters long making expensive cracking unnecessary. [not quite right see edit]

Rainbow tables are just giant tables where the key is the hash and the value is the string that generated it.

However, your example being 14 characters long is a bit long to be in most readily available rainbow tables.

This is why using salts and peppers are incredibly important regardless of what hash you use.

Edit: minor(ish) correction to the previous sentence. Full alphanumeric with punctuation and digits is available readily in smaller password lengths but the 10 character long datasets seem to be mostly only lower case characters and digits.

Re:I mean, why not tell everyone our password hashes? by agwa on Friday July 14, 2017 @10:35PM (#14774762)
> However, any possible password with a standard printable ASCII character set will typically be found in Rainbow tables up to 10 characters long making expensive cracking unnecessary.

Really? Storing every possible 10 character long printable ASCII password plus its MD5 hash would require approximately 1.5 zettabytes[1].

[1] 95^10 * (16+10)

Re:I mean, why not tell everyone our password hashes? by morecoffee on Friday July 14, 2017 @10:48PM (#14774799)
Rainbow tables are formed by chains of passwords and their hashes. The rainbow table only includes the ends of the chains, so you can throw away the middle of the chain.

Rainbow tables are a tradeoff between storing every hash, and generating them during cracking. You get to pick how much space you want to spend to speed up cracking.

Re:I mean, why not tell everyone our password hashes? by forgotpwtomain on Friday July 14, 2017 @10:32PM (#14774753)
>However, any possible password with a standard printable ASCII character set will typically be found in Rainbow tables up to 10 characters long making expensive cracking unnecessary.

Umm what? Even assuming a limited set of ASCII i.e. Base64, on what magical medium do you suppose a 64^10 rainbow table is stored?

Re:I mean, why not tell everyone our password hashes? by morecoffee on Friday July 14, 2017 @10:58PM (#14774820)
Any medium really. Rainbow tables are compressed (by throwing away most of the hashes). The amount you throw away determines how long it takes to crack.

For example, A rainbow table might use chain lengths of 10,000. This means that for every 10,000 hashes calculated, only 1 (really 2) are kept. Each chain ends up as a row in the table, which is then sorted. When cracking, the target hash is hashed and reversed up to 10,000 times looking through the table.

The more compression the less space needed, but longer look up. The original Windows XP rainbow table cracking CD published along with the Rainbow table paper was only ~500Mb, but was able to crack pretty much every windows password.

Re:I mean, why not tell everyone our password hashes? by Godel_unicode on Friday July 14, 2017 @11:23PM (#14774886)
An md5 rainbow table for lower alphanumeric which covers passwords of length 9 is 63gb. Length 10 is 316gb. You can see where this is going. It's important to note the caveat upfront; lower case-only plus numbers. No upper case, no symbols.

http://project-rainbowcrack.com/table.htm

Re:I mean, why not tell everyone our password hashes? by morecoffee on Friday July 14, 2017 @11:38PM (#14774933)
That is just a rainbow table, but there are many others. By modifying the chain length, you can make the table as arbitrarily small. The example commands on that site use a chain length of 3800, but it could be raised to 1 million.
Re:I mean, why not tell everyone our password hashes? by visarga on Saturday July 15, 2017 @04:22AM (#14775636)
If you know the md5 hash, why not login with another password that generates the same hash value? Does it actually need to be the same passord?
Re:I mean, why not tell everyone our password hashes? by throwaway2016a on Saturday July 15, 2017 @03:41PM (#14778516)
It will work but a common reason to crack passwords is because people use the same password on multiple sites. Getting the wrong value may work to log into that specific site but will not work where the user the real password elsewhere. (unless that other place is using the same hash algorithm)
Re:I mean, why not tell everyone our password hashes? by cyphar on Saturday July 15, 2017 @04:27AM (#14775647)
Yes, that will also work, hence why rainbow tables don't need to contain more entries than the possible set of hashes.
Re:I mean, why not tell everyone our password hashes? by bitJericho on Saturday July 15, 2017 @08:37AM (#14776371)
That's called a collision