Timeline for How long will it take to crack the passwords stolen in the Yahoo hack announced 14 Dec 2016?
Current License: CC BY-SA 3.0
50 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 23, 2017 at 12:40 | history | edited | CommunityBot |
replaced http://stackoverflow.com/ with https://stackoverflow.com/
|
|
| Mar 17, 2017 at 10:46 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| Dec 18, 2016 at 20:30 | comment | added | kasperd | @Craig I am not defending MD5. I am defending strong passwords and the use of salt in password hashing. If users care about security they are better off assuming websites will store passwords as unsalted MD5 hashes and choose their password accordingly. And there is such a thing as a password that remains secure under such a weak hash. Unsalted MD5 hashes is the weakest way to store passwords where it is still possible for users to compensate for that weakness by choosing a sufficiently strong password. Anything weaker than MD5 and it is already game over. | |
| Dec 18, 2016 at 19:12 | comment | added | Craig Tullis | Well, you wrote quite a lot, with the general thrust being defense of MD5 for hashing passwords. Don't get so worked up. The point of this discussion is that Yahoo was using straight MD5 hashes for passwords, which was a deplorable, utterly non-secure practice which, frankly for a company at their scale, should probably be actionable. | |
| Dec 18, 2016 at 19:09 | comment | added | kasperd | @Craig I am not going to defend a statement I didn't make. Pay better attention to what I actually wrote. | |
| Dec 18, 2016 at 18:34 | comment | added | Craig Tullis | LinkedIn, 140,000,000 passwords cracked, and those were done with SHA-1. Does PayPal work for you? I'm kidding. :) What was the recent breach where 4,000 bcrypt-hashed passwords were discovered within a few days? You'll never win trying to make people use stronger passwords. They will, or they won't. Seriously, though, the newer/stronger algorithms are just so easy to use that I don't see the point in the argument. Anything without salt is just silly. With salt, MD5 is still weaker. No point arguing, time to move on. | |
| Dec 18, 2016 at 18:29 | comment | added | kasperd | @Craig It needs to be 7 orders of magnitude faster in order to break a strong password before the sun burns out. I am not going to put an effort into configuring any system to use a hash as weak as MD5 today, because old the software I use happen to be using stronger hashes by default. I will however offer to pay you 100 euro if you can prove me wrong. | |
| Dec 18, 2016 at 17:52 | comment | added | Craig Tullis | There was a 25-GPU cluster burning through MD5 hashes at 180 billion per second in 2012. It was burning through 63 billion SHA-1 hashes per second. It only managed 71,000 bcrypt hashes per second, and 364,000 sha512crypt hashes per second. I mean, you're obviously free to use MD5 for your own stuff if you want, but I'm not going to. :-) | |
| Dec 18, 2016 at 17:44 | comment | added | kasperd | @Craig I am specifically talking about password hashing, not cryptographic hashing in general. Additionally it takes time from a cryptographic primitive is published until it can be considered secure. | |
| Dec 18, 2016 at 17:39 | comment | added | Craig Tullis | @kasperd: Since SHA-0 was published in 1993 and SHA-1 in 1995, MD5 was decidedly not state-of-the-art in 1997. Users choosing weak passwords is the norm, and you are doomed to failure trying to change that. So MD5 is inadequate on that basis alone. '97 might be a teensy bit early for my assertions, but if so, only by a year at most. Who cares what hash primitive NIST approved in 2007, respectfully. SHA-1 isn't even considered adequate today, and MD5 is far more susceptible to collisions than SHA-1. | |
| Dec 18, 2016 at 17:24 | comment | added | kasperd | @Craig Yes. I am seriously suggesting that MD5 crypt was still secure in 1997. And not just that. In 1997 MD5 was state of the art. It wasn't until 1999 that an alternative was proposed. And as of 2007, MD5 was still the strongest NIST approved primitive supported by the crypt library. Stronger hashes are supported today. But even today the only need for hashes stronger than MD5 is to compensate for users choosing weak passwords. | |
| Dec 18, 2016 at 15:21 | comment | added | Craig Tullis | Now, nearly 20 years later Yahoo still apparently has some straight MD5 hashes around because Mayer refused to enforce password changes/upgrades. My point is that a security-conscious, forward looking huge public Internet company would have been serious about this 20 years ago. Yahoo apparently still isn't serious about it. | |
| Dec 18, 2016 at 15:14 | comment | added | Craig Tullis | @kasperd you're not seriously suggesting that was still secure? As others have said, at least Linux password hashes were salted then, but the passwords were still truncated at 8 chars and salt was only 2 bytes. I was doing sha-1 with unlimited length passwords and 8 bytes of salt in systems I built at that time, and using HMAC algo's with multiple rounds shortly after. But too many were doing straight MD5, then straight SHA-1, and that's the only reason rainbow tables were ever even a viable attack vector. | |
| Dec 18, 2016 at 14:28 | comment | added | kasperd | @MichaelKjörling With 12 bits of salt it takes about 2⁶ passwords before you can expect to see the first salt collision. If you have 10 users and require them to change password once per year, you can expect a salt collision in about 6 years. If you have 100 users you can expect a salt collision before anybody have changed password for the first time. And many sites will have even more users than that. So I don't think 12 bits of salt was sufficient even back in those days. | |
| Dec 18, 2016 at 14:21 | comment | added | kasperd |
@MichaelKjörling The largest problems with the DES based crypt is that it truncates passwords to 8 characters. The second largest problem is that the produced hash value is only 64 bits. The small salt comes in as the third worst problem. And based on my understanding of how that algorithm works, it was a totally arbitrary choice to use 12 bits. They could have had 64 bits at no extra cost. The point of my comment was that in 1997 it would be a sensible choice to go with MD5, but having no salt was inexcusable.
|
|
| Dec 18, 2016 at 13:21 | comment | added | user |
@kasperd Even the UNIX DES crypt uses a salt. It's small by today's standards (12 bits), but it's a salt, and it was probably quite sufficient at the time.
|
|
| Dec 18, 2016 at 13:15 | comment | added | user | @Thebluefish When I changed my password on Yahoo in response to the breach (my account is ages old, dating back to the eGroups days; I haven't actually used Yahoo in years), the maximum length as enforced by the password change web form was 32 characters. Still inexcusable IMO (it made me have to special-case Yahoo in my password manager, and it basically prevents using anything resembling a secure passphrase) but not quite so bad as would be a maximum of 20 characters. I think Paypal has a limit of 20 characters, though... | |
| Dec 18, 2016 at 8:57 | comment | added | kasperd |
@Craig When I installed my first Linux system in 1999, /etc/shadow was using salted MD5 by default. And at that time I had to use systems on a daily basis on which the original DES based crypt algorithm was still being used for compatibility reasons. And if a salted MD5 hash is brute forced, it is partly the users own fault for choosing such a weak password that this could happen.
|
|
| Dec 18, 2016 at 2:57 | comment | added | Craig Tullis | Why would anybody have even considered using MD5 for password hashing under any circumstances after about 1997(ish)? This was completely inexcusable on Yahoo's part. Utter bush-league amateur-hour baloney and no excuses. | |
| Dec 17, 2016 at 17:35 | comment | added | Nzall | Small correction: Ashley Madison DID in fact use MD5 for some of their passwords. about half of the userbase had an additional stored hash of their password with some additional data in there like a username and a fixed string suffix. These passwords were hashed with unsalted MD5 and were rather easily recovered. | |
| Dec 16, 2016 at 18:52 | comment | added | Brian | @aroth Yahoo's password database probably dates back to 1995. Plus, Yahoo is notorious for their terrible security. I would be very surprised if the passwords were salted. | |
| Dec 16, 2016 at 15:20 | comment | added | BlueWizard | "in some cases, encrypted or unencrypted security questions and answers." so you are telling me they encryted their security questions but didn't used MD5 for their passwords? Yahoo get your shit together. You should not encrypt the question/answers and you should not use MD5 for the passwords. But should use bcrypt with a big amount of salt. Everything below that is just dangerous | |
| Dec 16, 2016 at 15:17 | comment | added | BlueWizard | @Luc MD5 is broken but fine for password hashing? Oh please stop saying that. MD5 is fast and that is good. But it's not usable for password hashing. Saving an MD5 or saving plaintext doesn't make a difference. Use bcrypt if you want to store passwords | |
| Dec 16, 2016 at 12:09 | history | edited | Arminius | CC BY-SA 3.0 |
added 280 characters in body
|
| Dec 16, 2016 at 8:12 | vote | accept | soadyp | ||
| Dec 16, 2016 at 7:57 | comment | added | KDEx | Hashcat benchmark for a new GTX 1080.. 25 Billion hashes per second (per device) on MD5 gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 | |
| Dec 16, 2016 at 3:08 | comment | added | aroth | @DavidGrinberg - Yes, really. The startup I was working with in 2004 knew enough to salt and hash its passwords. The medium enterprise I worked at afterwards (ca 2007) knew the same. As have the small businesses I've worked with more recently. And in this case, we're talking about a $36-billion technology company which at one point ranked as a peer to Google, and a breach which occurred in 2013. I don't see how that level of rank incompetence is possible, let alone predictable or even unsurprising. | |
| Dec 16, 2016 at 2:08 | history | edited | Arminius | CC BY-SA 3.0 |
added 22 characters in body
|
| Dec 16, 2016 at 0:43 | history | edited | Arminius | CC BY-SA 3.0 |
added 9 characters in body
|
| Dec 15, 2016 at 21:41 | comment | added | kasperd | @Thebluefish I didn't know about the 20 character limit. That is also inexcusable. Though 20 characters chosen randomly from all of the printable ASCII characters will give you approximately 131 bits of entropy, and MD5 only has 128 bits of output. So the 20 character limit would not be the weakest link. | |
| Dec 15, 2016 at 21:32 | comment | added | user41341 | @kasperd It sounds like your password is probably longer than Yahoo's maximum 20 character limit. I'll agree that without limits, it's very easy to make a difficult password; but these damn restrictions... | |
| Dec 15, 2016 at 21:28 | comment | added | kasperd | @Thebluefish A rainbow table won't contain the most secure passwords. I would rate it as extremely unrealistic that anybody have ever computed a rainbow table covering 2⁹⁰ or more hashes. And if somebody had a rainbow table covering that many hashes, there would still only be 1 in 274877906944 chance that it would contain a match for my password. So the most secure passwords are still secure even if hashed with an unsalted MD5. In spite of that it is still utterly inexcusable to not be salting your hashes. | |
| Dec 15, 2016 at 19:08 | history | edited | Arminius | CC BY-SA 3.0 |
added 467 characters in body
|
| Dec 15, 2016 at 18:18 | comment | added | Ismael Miguel | @Thebluefish Anyone who watched Computerphile (on Youtube) already has a basic understanding on how to "crack" MD5 hashes. The video has enough detail on how to do it, I can link it if you want. | |
| Dec 15, 2016 at 16:47 | comment | added | jpmc26 | @Luc Anyone who doesn't already understand that "MD5 is broken for password hashing" implicitly refers to the simplistic, single hash has no business trying to roll their own many rounds hashing scheme using MD5. If a person doesn't know enough about hashing to have a discussion about it, they should be using standard implementations that handle those details for them. Full stop. Besides, isn't even multiple round hashing of MD5 more easily optimized in GPUs than others, which makes it inferior as a password hashing algorithm? | |
| Dec 15, 2016 at 15:51 | comment | added | user41341 | If these are unsalted passwords, then any competent hacker will already have access to a full rainbow table. Even the most "secure" passwords would break instantly if the table had them, and we've had quite a long time to generate tables of any reasonable size & complexity. | |
| Dec 15, 2016 at 15:08 | comment | added | Maurycy | @Luc the thing is if you say "MD5 is fine for password hashing provided you use a big number of rounds" most people hear "MD5 is fine for password hashing" completely ignoring the rest. This way saying that MD5 is unsuitable for password hashing will at least prompt some people to ask "Okay, so WHAT is suitable?" and maybe this way we can propagate the knowledge about how to do things rights. | |
| Dec 15, 2016 at 15:02 | comment | added | David says Reinstate Monica | @aroth Really? Is this your first time hearing of a big hack? Until fairly recently it was pretty common to hear about passwords stolen in plain text. Its still totally inexcusable, but you shouldn't see it as so surprising. | |
| Dec 15, 2016 at 12:06 | comment | added | aroth | "Also, they are likely not salted, since Yahoo would have certainly let us know" - How on Earth could a tech company as large as Yahoo not have been salting their password hashes?!? If this is true, it's inexcusable. | |
| Dec 15, 2016 at 9:07 | comment | added | Luc | @Anders that's not the point. The point is that any hashing algorithm would have been just as bad, but instead people keep repeating how terrible a choice md5 in particular is. What you need is an algorithm designed for password storage like bcrypt (as we, on this site, all know). | |
| Dec 15, 2016 at 8:45 | comment | added | Anders | @Luc I agree with you in principle, but had they used multiple rounds I assume they would have mentioned it, as it would had made them look a little better. | |
| Dec 15, 2016 at 8:11 | comment | added | Arminius | @Luc I softened the statement a little. | |
| Dec 15, 2016 at 8:09 | history | edited | Arminius | CC BY-SA 3.0 |
deleted 75 characters in body
|
| Dec 15, 2016 at 8:01 | comment | added | Arminius | @Luc MD5 as PRF, sure. But MD5 for a password that should not be easily recovered in case of a breach? Why wouldn't there be a slower function the better choice? | |
| Dec 15, 2016 at 7:59 | comment | added | soadyp | So if Yahoo didnt SALT, we are looking at weeks and all/most passwords are cracked. Wow, I will give people a chance to comment before marking correct answer. | |
| Dec 15, 2016 at 7:52 | comment | added | Luc | "The MD5 algorithm is obsolete and cracking MD5-hashed passwords is super-fast." You make it sounds like MD5 is a broken hashing algorithm. And yes, MD5 certainly has flaws, but it's still fine for password hashing. However, using a single round of any hashing algorithm is wrong. MD5 as PRF is perfectly fine, just like SHA1/SHA2/etc. | |
| Dec 15, 2016 at 7:52 | comment | added | grc | 11 million guesses per second seems quite slow for MD5. | |
| Dec 15, 2016 at 7:51 | history | edited | Arminius | CC BY-SA 3.0 |
added 857 characters in body
|
| Dec 15, 2016 at 7:39 | history | edited | Arminius | CC BY-SA 3.0 |
added 857 characters in body
|
| Dec 15, 2016 at 7:15 | history | answered | Arminius | CC BY-SA 3.0 |