Timeline for How long will it take to crack the passwords stolen in the Yahoo hack announced 14 Dec 2016?
Current License: CC BY-SA 3.0
25 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 18, 2016 at 17:56 | answer | added | gnasher729 | timeline score: 3 | |
| Dec 18, 2016 at 0:42 | comment | added | user541686 | Most likely the correct question would be "how long did it take"... | |
| Dec 17, 2016 at 2:20 | comment | added | dwkd | You need to understand that since day one that MD5 was invented, a multitude of actors (good or bad) had started working towards building a complete hash database of character combinations and their resulting hash (most likely at least all Permitations of the 128 US-ASCII characters in sets of at least 15-20) So this means that in the wrong hands, his can be cracked in seconds since big data lookup is ever increasingly faster | |
| Dec 17, 2016 at 1:01 | answer | added | keshlam | timeline score: 5 | |
| Dec 16, 2016 at 22:13 | history | protected | Rory Alsop♦ | ||
| Dec 16, 2016 at 9:56 | comment | added | Radu Murzea | Hmmm, I wonder if Yahoo salts the passwords before hashing... | |
| Dec 16, 2016 at 9:52 | comment | added | James Snell | @soadyp - it's news because we now know that a significant number more than originally thought had been stolen, this information is new. | |
| Dec 16, 2016 at 8:18 | comment | added | soadyp | I read after i posted the Question, that it relates to an Incident in AUG 2013. Im not sure why this suddenly became a news topic again. I changed my password for the 2nd time on Yahoo inside 2 years. | |
| Dec 16, 2016 at 8:12 | vote | accept | soadyp | ||
| Dec 16, 2016 at 2:25 | comment | added | Drunken Code Monkey | I find inexcusable that a site with such a large database would use simple MD5 hashes unencrypted in the database. I would personally take a SHA256 hash of the password, use that to encrypt the public key to their generated private RSA key with AES, and store the encrypted cipher in the database. If someone gets the database, they still need to A) figure out the password to hash, B) use the hash to decrypt the cipher, and C) use the decrypted cipher as my public key to try to decrypt other stuff (typically account details). And even if they do, they have access to ONE account. | |
| S Dec 15, 2016 at 20:05 | history | suggested | Monty Harder | CC BY-SA 3.0 |
Fixed title. The crack "of" a date suggests that's when it actually happened. This is when it was reported.
|
| Dec 15, 2016 at 18:46 | review | Suggested edits | |||
| S Dec 15, 2016 at 20:05 | |||||
| Dec 15, 2016 at 18:45 | comment | added | john_science | @soadyp Some passwords will be MUCH easier to crack than others. For instance, if you made the mistake of using one of the most common (and short) 10,000 passwords, those can be rainbow tabled in linear time, yes. For people who used longer-and-more-complex passwords, MD5 still has 123 bits of complexity. And the time to break each password will depend on its length-and-complexity, which will take greater than linear time to crack. | |
| Dec 15, 2016 at 18:29 | comment | added | Leliel | @grc Unless they're using MD5 as the base for a prf, I'd say that after 3 years, they've got everything they're ever going to. | |
| Dec 15, 2016 at 13:59 | comment | added | user126602 | Most of the passwords have been cracked before the hack even happened. There are numerous databases with precalculated hashes, and even online services which let you search for a match: md5decryption.com | |
| Dec 15, 2016 at 13:51 | comment | added | xanatos | To quote from the site “Based on further analysis of this data by the forensic experts, we believe an unauthorized third party, in August 2013, stole data... | |
| Dec 15, 2016 at 12:24 | comment | added | grc | Don't forget this happened in 2013 - most of the passwords could already be cracked. | |
| Dec 15, 2016 at 12:03 | history | tweeted | twitter.com/StackSecurity/status/809368236038950912 | ||
| Dec 15, 2016 at 8:13 | comment | added | Jacco | Some team build a computer that could do 350 billion guesses per second... and that was in 2012. | |
| Dec 15, 2016 at 8:03 | answer | added | Luc | timeline score: 21 | |
| Dec 15, 2016 at 7:56 | history | edited | soadyp | CC BY-SA 3.0 |
edit to clarifiy
|
| Dec 15, 2016 at 7:44 | comment | added | Julian Knight | This cannot be properly answered since anyone who simply used one of the most common insecure passwords like 12345 or Password123 will be done in seconds. But secure and longer passwords will take a lot more time. | |
| Dec 15, 2016 at 7:18 | history | edited | Anders | CC BY-SA 3.0 |
deleted 11 characters in body; edited tags; edited title
|
| Dec 15, 2016 at 7:15 | answer | added | Arminius | timeline score: 69 | |
| Dec 15, 2016 at 7:09 | history | asked | soadyp | CC BY-SA 3.0 |