In the Gawker data breach, was just the database stolen and that gave free access to all user data? Or did the hackers still need to read the MD5's of the usernames and passwords to gain access to the data?

If you had a strong, non-dictionary, 12+ character password, is there any need to worry?

  • 1
    Why worry? Change your password. – schroeder Jan 10 '12 at 20:59

The strength of a password is related to two things:

  • Entropy -- Relative strength as measured in bits.
  • Iteration speed -- How long it would take to exhaustively test against a certain function.

Gawker used DES crypt hash method (not the best choice). That seems to be roughly 10 times slower to brute force than MD5. A GeForce 8800 Ultra (2007 vintage) is widely cited as tackling 200 million MD5 hashes per second. My GeForce 560 TI is about four times as fast. 200*4/10 = 80 million DES crypt hashes per second.

A password of 26+26+10+10 (lower, upper, numbers, 10 symbols) and 12 characters long is worth 274 bits of entropy. DES maxes out at 256. Wolfram Alpha tells me you've got a little bit of wiggle room against one graphics card at 256 bits of entropy.

Alternately, there's the DES cracker perspective where the entire keyspace could be tested in about 10 days in 1998 by an EFF pet project. Thus, your relatively strong password might still be defeated by the limitations of a smaller hashing space and a quickly attacked algorithm.

I wouldn't hold my breath, but at least you won't end up on a top passwords list.

  • 1
    ...or nearly 300 billion DES keys per-second, with an average crack time of under 24 hours on a $10,000 bit of hardware. link – pdubs Jan 10 '12 at 19:32
  • ^ How much would it be to rent one of those off of AWS for 24 hours? – StrangeWill Jan 10 '12 at 20:12
  • @StrangeWill aws.amazon.com/ec2/pricing ? – Jeff Ferland Jan 10 '12 at 21:27
  • 1
    So, assuming their GPU cluster is about $4,000 (Dual Teslas), we're looking at breaking your DB for a little over $125? Sweet. – StrangeWill Jan 10 '12 at 22:28

No, it is not OK. Gawker used DES encryption instead of a strong hashing method. DES is weak enough to brute-force on modern hardware.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.