Re:StockX was hacked, exposing millions of customers’ data
by xwdv on Sunday August 04, 2019 @06:32PM
(#20609661)
Show me the benchmarks.
[ Parent
| on HN ]
Re:StockX was hacked, exposing millions of customers’ data
by dehrmann on Sunday August 04, 2019 @07:11PM
(#20609824)
https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...
Looking at phpass (one of the md5 algorithms), a high-end GPU can do 7M hashes per sec.
Re:StockX was hacked, exposing millions of customers’ data
by txcwpalpha on Monday August 05, 2019 @01:36AM
(#20611549)
If StockX was using phpass (which is a KDF that uses MD5 as a base but adds multiple permutations on top), it is quite a bit safer (but still not recommended and these hashes should be considered to be compromised).
The bigger issue is if they were actually using raw MD5 (which is sadly quite common), which is benchmarked at 25 billion (with a B) hashes per sec per GPU.
Re:StockX was hacked, exposing millions of customers’ data
by blondin on Sunday August 04, 2019 @08:32PM
(#20610131)
nowhere in these benchmarks anyone said the MD5 were salted. am i reading it wrong?
Re:StockX was hacked, exposing millions of customers’ data
by thenewnewguy on Sunday August 04, 2019 @08:42PM
(#20610170)
Unless you're operating under the (likely incorrect) assumption that the salts aren't leaked than salting the password doesn't matter for attacking a single user - it just means you can't reuse your results for other users.