LivingSocial Hacked – 50 Million Customers Affected

Re:LivingSocial Hacked – 50 Million Customers Affected by StavrosK on Friday April 26, 2013 @06:53PM (#5615972)

The attacker does, of course, have the salts as well, since they're part of the hash. I don't see how they can try hundreds of billions of password combinations per second, though.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by bcoates on Friday April 26, 2013 @07:33PM (#5616104)

http://securityledger.com/new-25-gpu-monster-devours-passwor...

25 late 2012 vintage GPUs gets you 180 billion MD5 tries per second. With a fairly modest budget you can rent a whole lot more GPU power than that. A little Googling gets me several companies offering password hash cracking as a service.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by elithrar on Friday April 26, 2013 @08:40PM (#5616312)

> 25 late 2012 vintage GPUs gets you 180 billion MD5 tries per second. With a fairly modest budget you can rent a whole lot more GPU power than that. A little Googling gets me several companies offering password hash cracking as a service.

But we're assuming, at the very least, that they're not using MD5 and are instead using SHA-2/SHA-256 or (s|b)crypt.

There's an order of magnitude difference between brute forcing MD5 and brute forcing something better.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by floody-berry on Friday April 26, 2013 @09:00PM (#5616368)

http://hashcat.net/oclhashcat-plus/

MD5 is 2-3x as fast as SHA-1

MD5 is 5-7x as fast as SHA-256

I don't know why anyone would assume they are using anything better than MD5/SHA-1 considering the history of incidents like this.

[ Parent | on HN ]

Re:LivingSocial Hacked – 50 Million Customers Affected by floody-berry on Sunday April 28, 2013 @05:55AM (#5620770)

https://www.livingsocial.com/createpassword: "LivingSocial passwords were hashed with SHA1 using a random 40 byte salt."

Shocker!

[ Parent | on HN ]