7 Removed unnecessary note.
source | link

Note: People keep downvoting me without letting me know. What did I do wrong ? I am asking sincerely.

Some kind-heart hacker just sql-injected our website, getting the hash of admin password of 10 lower case chars. It took him half a day to crack it without knowing the SALT (he know that we use "sha256" because the site is opensource).

Now, the manager is not happy. Obviously we will have to change the algorithm to something unpredictable, and a strong admin password, apart from patching that sql-inject hole.

Points to consider:

  • Password are strong like : "MyB0y6thJan@)!%" : my boy 6th Jan 2015 -> easier to remember. Or passphrase "we love this website so much"

  • The hackers are usually pro ones, they attacked us all the time. They may have access to 10-100 strong computer.

  • Hackers may think we are using sha256 as in the opensource but we will change them to something strong like bcrypt.

  • we would change password every month.

Question: if they manage to sql inject and get the hash in the future, would he be able to crack it fast?

P/S : I have read many similar topic like :

Estimate the time to crack passwords using bcrypt.

How do we estimate the time taken to crack a hash using brute force techniques

But still I am so confused now, many people ( including the hacker) claim that any hash password can be cracked to its original form, just a matter of time. While many say it may take years to crack just one.

Note: People keep downvoting me without letting me know. What did I do wrong ? I am asking sincerely.

Some kind-heart hacker just sql-injected our website, getting the hash of admin password of 10 lower case chars. It took him half a day to crack it without knowing the SALT (he know that we use "sha256" because the site is opensource).

Now, the manager is not happy. Obviously we will have to change the algorithm to something unpredictable, and a strong admin password, apart from patching that sql-inject hole.

Points to consider:

  • Password are strong like : "MyB0y6thJan@)!%" : my boy 6th Jan 2015 -> easier to remember. Or passphrase "we love this website so much"

  • The hackers are usually pro ones, they attacked us all the time. They may have access to 10-100 strong computer.

  • Hackers may think we are using sha256 as in the opensource but we will change them to something strong like bcrypt.

  • we would change password every month.

Question: if they manage to sql inject and get the hash in the future, would he be able to crack it fast?

P/S : I have read many similar topic like :

Estimate the time to crack passwords using bcrypt.

How do we estimate the time taken to crack a hash using brute force techniques

But still I am so confused now, many people ( including the hacker) claim that any hash password can be cracked to its original form, just a matter of time. While many say it may take years to crack just one.

Some kind-heart hacker just sql-injected our website, getting the hash of admin password of 10 lower case chars. It took him half a day to crack it without knowing the SALT (he know that we use "sha256" because the site is opensource).

Now, the manager is not happy. Obviously we will have to change the algorithm to something unpredictable, and a strong admin password, apart from patching that sql-inject hole.

Points to consider:

  • Password are strong like : "MyB0y6thJan@)!%" : my boy 6th Jan 2015 -> easier to remember. Or passphrase "we love this website so much"

  • The hackers are usually pro ones, they attacked us all the time. They may have access to 10-100 strong computer.

  • Hackers may think we are using sha256 as in the opensource but we will change them to something strong like bcrypt.

  • we would change password every month.

Question: if they manage to sql inject and get the hash in the future, would he be able to crack it fast?

P/S : I have read many similar topic like :

Estimate the time to crack passwords using bcrypt.

How do we estimate the time taken to crack a hash using brute force techniques

But still I am so confused now, many people ( including the hacker) claim that any hash password can be cracked to its original form, just a matter of time. While many say it may take years to crack just one.

6 added 150 characters in body
source | link

Note: People keep downvoting me without letting me know. What did I do wrong ? I am asking sincerely.

Some kind-heart hacker just sql-injected our website, getting the hash of admin password of 10 lower case chars. It took him half a day to crackhalf a day to crack it without knowing the SALT (he know that we use "sha256" because the site is opensource).

Now, the manager is not happy. Obviously we will have to change the algorithm to something unpredictable, and a strong admin password, apart from patching that sql-inject hole.

What would it take for future hackersPoints to crack an exposed strong password (see below), with unexpected algorithm & factor/cost (hackers may think we are using sha256 as in the opensource)? Assuming they have 10-20 powerful cracking devices ( strong computer with good GPU? ). Or how about strong organization like NSA, just wondering? consider:

  • Password are strong like : "MyB0y6thJan@)!%" : my boy 6th Jan 2015 -> easier to remember. Or passphrase "we love this website so much"

  • The hackers are usually pro ones, they attacked us all the time. They may have access to 10-100 strong computer.

  • Hackers may think we are using sha256 as in the opensource but we will change them to something strong like bcrypt.

  • we would change password every month.

Example : "MyB0y6thJan@)!%" Question: my boy 6th Jan 2015 -> easierif they manage to remember.sql inject and get the hash in the future, would he be able to crack it fast?

P/S : I have read many similar topic like :

Estimate the time to crack passwords using bcrypt.

How do we estimate the time taken to crack a hash using brute force techniques

But still I am so confused now, many people ( including the hacker) claim that any hash password can be cracked to its original form, just a matter of time. While many say it may take years to crack just one.

Note: People keep downvoting me without letting me know. What did I do wrong ? I am asking sincerely.

Some kind-heart hacker just sql-injected our website, getting the hash of admin password of 10 lower case chars. It took him half a day to crack it without knowing the SALT (he know that we use "sha256" because the site is opensource).

Now, the manager is not happy. Obviously we will have to change the algorithm to something unpredictable, and a strong admin password, apart from patching that sql-inject hole.

What would it take for future hackers to crack an exposed strong password (see below), with unexpected algorithm & factor/cost (hackers may think we are using sha256 as in the opensource)? Assuming they have 10-20 powerful cracking devices ( strong computer with good GPU? ). Or how about strong organization like NSA, just wondering?

Example : "MyB0y6thJan@)!%" : my boy 6th Jan 2015 -> easier to remember.

P/S : I have read many similar topic like :

Estimate the time to crack passwords using bcrypt.

How do we estimate the time taken to crack a hash using brute force techniques

But still I am so confused now, many people ( including the hacker) claim that any hash password can be cracked to its original form, just a matter of time. While many say it may take years to crack just one.

Note: People keep downvoting me without letting me know. What did I do wrong ? I am asking sincerely.

Some kind-heart hacker just sql-injected our website, getting the hash of admin password of 10 lower case chars. It took him half a day to crack it without knowing the SALT (he know that we use "sha256" because the site is opensource).

Now, the manager is not happy. Obviously we will have to change the algorithm to something unpredictable, and a strong admin password, apart from patching that sql-inject hole.

Points to consider:

  • Password are strong like : "MyB0y6thJan@)!%" : my boy 6th Jan 2015 -> easier to remember. Or passphrase "we love this website so much"

  • The hackers are usually pro ones, they attacked us all the time. They may have access to 10-100 strong computer.

  • Hackers may think we are using sha256 as in the opensource but we will change them to something strong like bcrypt.

  • we would change password every month.

Question: if they manage to sql inject and get the hash in the future, would he be able to crack it fast?

P/S : I have read many similar topic like :

Estimate the time to crack passwords using bcrypt.

How do we estimate the time taken to crack a hash using brute force techniques

But still I am so confused now, many people ( including the hacker) claim that any hash password can be cracked to its original form, just a matter of time. While many say it may take years to crack just one.

5 deleted 207 characters in body
source | link

Note: People keep downvoting me without letting me know. What did I do wrong ? I am asking sincerely.

Some kind-heart hacker just sql-injected our website, getting the hash of admin password of 10 lower case chars. It took him half a day to crack it without knowing the SALT (he know that we use "sha256" because the site is opensource).

Now, the manager is not happy. Obviously we will have to change the algorithm to something unpredictable, and a strong admin password, apart from patching that sql-inject hole.

What would it take for future hackers to crack an exposed strong password (see below), with unexpected algorithm & factor/cost (hackers may think we are using sha256 as in the opensource)? Assuming they have 10-20 powerful cracking devices ( strong computer with good GPU? ). Or how about strong organization like NSA, just wondering?

Example : "MyB0y6thJan@)!%" : my boy 6th Jan 2015 -> easier to remember.

P/S : I have read many similar topic like :

Estimate the time to crack passwords using bcrypt.

How do we estimate the time taken to crack a hash using brute force techniques

But still I am so confused now, many people ( including the hacker) claim that any hash password can be cracked to its original form, just a matter of time. While many say it may take years to crack just one.

We are asking because we are not sure that we can make the website 100% sql inject proof, and this is serious problem to us. If you dislike the question, please leave a comment instead of downvoting it.

Note: People keep downvoting me without letting me know. What did I do wrong ? I am asking sincerely.

Some kind-heart hacker just sql-injected our website, getting the hash of admin password of 10 lower case chars. It took him half a day to crack it without knowing the SALT (he know that we use "sha256" because the site is opensource).

Now, the manager is not happy. Obviously we will have to change the algorithm to something unpredictable, and a strong admin password, apart from patching that sql-inject hole.

What would it take for future hackers to crack an exposed strong password (see below), with unexpected algorithm & factor/cost (hackers may think we are using sha256 as in the opensource)? Assuming they have 10-20 powerful cracking devices ( strong computer with good GPU? ). Or how about strong organization like NSA, just wondering?

Example : "MyB0y6thJan@)!%" : my boy 6th Jan 2015 -> easier to remember.

P/S : I have read many similar topic like :

Estimate the time to crack passwords using bcrypt.

How do we estimate the time taken to crack a hash using brute force techniques

But still I am so confused now, many people ( including the hacker) claim that any hash password can be cracked to its original form, just a matter of time. While many say it may take years to crack just one.

We are asking because we are not sure that we can make the website 100% sql inject proof, and this is serious problem to us. If you dislike the question, please leave a comment instead of downvoting it.

Note: People keep downvoting me without letting me know. What did I do wrong ? I am asking sincerely.

Some kind-heart hacker just sql-injected our website, getting the hash of admin password of 10 lower case chars. It took him half a day to crack it without knowing the SALT (he know that we use "sha256" because the site is opensource).

Now, the manager is not happy. Obviously we will have to change the algorithm to something unpredictable, and a strong admin password, apart from patching that sql-inject hole.

What would it take for future hackers to crack an exposed strong password (see below), with unexpected algorithm & factor/cost (hackers may think we are using sha256 as in the opensource)? Assuming they have 10-20 powerful cracking devices ( strong computer with good GPU? ). Or how about strong organization like NSA, just wondering?

Example : "MyB0y6thJan@)!%" : my boy 6th Jan 2015 -> easier to remember.

P/S : I have read many similar topic like :

Estimate the time to crack passwords using bcrypt.

How do we estimate the time taken to crack a hash using brute force techniques

But still I am so confused now, many people ( including the hacker) claim that any hash password can be cracked to its original form, just a matter of time. While many say it may take years to crack just one.

4 added 11 characters in body
source | link
3 added 11 characters in body
source | link
2 added 385 characters in body
source | link
1
source | link