New answers tagged

2

Yes, of course it is possible; an easy example is that the current owner has a password, and so if you try every single password in existence you will eventually get the right one. This is, however, not a feasible method, nor a legal one. Your best bet is to go through Facebook's account recovery procedures, and to take this as a lesson to make sure you've ...


-2

No. It is not possible Cryptographically brute force. CVV generation uses one round DES and one round Triple-DES encryption and then first 3 numeric digits are selected from output(decimalization). As strong cryptographic algorithms are used for generation it is not possible to brute force CVV Cryptographically. Refer to my answer : https://stackoverflow.com/...


1

Hash on the rainbow table: instantaneous. Bruteforce a hash: depends heavily on the hash type (MD5, SHA, etc), how many rounds, if it's salted or not, hardware used... 948 is not that big. A system calculating 100 billion MD5 hashes per second will run all the possible passwords in about 17 hours. MD5 is bad for this, but the same system will do the same ...


2

It depends what kind of encryption/format you have. Currently, there are many formats which cryptsetup support. Basically, the most popular are LUKS1 and LUKS2. You can check what kind of format you have with following command: cryptsetup luksDump <device> John the Ripper only supports CPU cracking with LUKS1 and specific combination of encryption/...


0

By default, BitLocker encryption uses a security device, the TPM chip, for key storage. So windows stores the key inside the TPM and makes sure that the TPM does not "hand out" the key unless the original windows system on which the key was created is booted. So how does this protect your data? You're protected because there's still the windows logon ...


0

No. The whole point of a decent one-way encryption is that just knowing how the encryption works is insufficient to reverse it. If that weren't the case, people like yourself would be able to decrypt other people's data with only the small amount of information you've told us you have. It is self-evident that that is not security. These algorithms are ...


0

Answering my own question a few months later -- it turns out there is some (very recent) research here. Beyond Credential Stuffing: Password Similarity Models using Neural Networks by Bijeeta Pal et. al. introduces some work that cracks passwords by using a users other known passwords, and introduces the concept of a "personal password meter" I'm not an ...


0

Define simple. Given that you know and have the algorithm, and can verify it for an example, it is trivial to "brute force" the other passwords. Given sufficient resources, and time. If you break the space up into blocks (work units) and test in parallel things will be easier. Barring a click frenzy driven resource drought you could have a hundred thousand ...


3

Ghedipunk mentions this solution but I wanted to expand upon it. If you are able to duplicate the hashing mechanism successfully, then you can update your users passwords just-in-time. That is, when a user logs in check if their account credentials are stored using the old method. If it is, validate the credentials against the old method and then ...


2

You got it wrong There is no "has to be". To see that, you only need to consider this: if there is a way, no password can be protected from a previous employee. And then, from any employee. And then, from any person, really. Passwords are stored with cryptographic hash to prevent that anybody to see the original data. This includes you. You need not to ...


1

As the other answers state, recovering the passwords directly will not be possible. However, given that the data you want is the user notes, there are other options: DB Admin User Presuming you have legitimate access to the back end, you could pull the data as a admin user of the db. (see Trotski94's comment) MITM You could deploy the new dashboard, and ...


27

I will add to the plethora of answers here with a simple example, because I find that reducing things to the basics can often be very informative. The key is that hashing algorithms destroy data. An Argon2 hash always has 32 bytes even if you feed it all of Wikipedia. The only way to make that happen is by throwing away lots of data, and once thrown away it ...


7

No, the information about known passwords will be of no help to crack the unknown passwords. Hashes are the result of one-way trapdoor functions. Hashing differs from encryption in that encryption can be reversed, whereas hashing cannot. Hashing destroys information, and there is no way to reconstruct the original password from a secure hash. If there is a ...


23

Your question is a little confusing, so if the following doesn't fully fit your situation, please correct the following assumptions: Your system stores encrypted data for multiple users. Each user's data is encrypted using a unique per-user key, or using a master key that is encrypted (wrapped) with a per-user key. Each user's key is either encrypted (...


40

Short answer: You can not decrypt the hash. You will have to use other means to recover it. Explanation: The result of a hash isn't an encrypted version of the password. It can not be decrypted, any more than you can take hashbrowns and rebuild a full potato. The result of a cryptographic hash is a scrambled up version of the data, with much of the ...


4

The short answer is that all the info you have helps but if you are unwilling to take the time to make 58 phone calls, then you will not like the weeks/months/years it might take, even with all your inside information. Consider this: every password system everywhere is the same as yours: they know the hash, the system, and they can make as many of their ...


0

I know that there is a vulnerability with WPS, even when using WPA2, but aside from that is WPA2-PSK really secure? Define secure. In the general sense, if you have WPS disabled, are using a long PSK and avoid default SSIDs, you should be okay. Unless you have a reason to have your network targeted by an entity with resources to brute force your network, ...


Top 50 recent answers are included