Re:StockX was hacked, exposing millions of customers’ data
by txcwpalpha on Sunday August 04, 2019 @07:46PM
(#20609983)
Those time periods also assume that you're just blindly cracking every possible 8-character combination, but you don't have to do that. Running your cracker against a password list like rockyou will probably get you 90%+ of passwords cracked in less than one second per hash with that same hardware.
That's 7.2 billion hashes per second per single Radeon GPU for md5. For 8 character password with numbers and letters that's 8.5 hours max and 4.25h on average.. The numbers only got better since then, I expect it's at least halved for this year's hardware. (edit: 1080ti does 32GHps, so yeah... make that 1h on average https://www.servethehome.com/password-cracking-with-8x-nvidi... )
Assumptions, not specified in the article:
- The salt is stored with the hash (this is a standard approach)
- It's only a trivial implementation with a single round of MD5. If they used multiple rounds or PBKDF1, then the hash choice doesn't matter as much.