News for hackers. Stuff that matters.

A comment on Pulling JPEGs out of thin air. Parent comment

Re:Pulling JPEGs out of thin air by smkdtr on Friday November 07, 2014 @01:22PM (#8573873)
Along similar lines, I wonder if this fuzzer can be used to bruteforce passwords for applications. Would it do any better than standard "try all the combinations" method?
[ Parent | on HN ]
Re:Pulling JPEGs out of thin air by owenmarshall on Friday November 07, 2014 @01:28PM (#8573915)
If the password is generated with a sane KDF - bcrypt/scrypt/pbdkf2, no.

If it's not, better attacks exist than trying every single password.

If you're trying to crack the application - not the password - maybe, but I kinda doubt it.

[ Parent | on HN ]
Re:Pulling JPEGs out of thin air by tptacek on Friday November 07, 2014 @01:41PM (#8573985)
Not really, because it depends on collecting traces from the target, and if you can do that you can usually just read the password out of memory.
[ Parent | on HN ]
Re:Pulling JPEGs out of thin air by bri3d on Friday November 07, 2014 @01:51PM (#8574028)
On the flip side, it could probably be used as a really slow universal keygen for naive license-key implementations :)
[ Parent | on HN ]