Password Cracking - Computerphile
Why Stack Overflow recommends it
Stack Overflow users link it when answering questions about breaking or reversing password hashes, as a clear explanation of why hashes can't be decoded but weak passwords can be brute-forced.
Recommended by 3 people across 3 different months, 2016 to 2019.
Why Information Security Stack Exchange recommends it
Information Security Stack Exchange users link it to illustrate how fast attackers can test guesses against stolen password hashes and how wordlists and mutation rules work.
Recommended by 0 people across 0 different months, 2017 to 2019.
What it is
A Computerphile episode in which Dr Mike Pound of the University of Nottingham explains how password hashes are cracked by brute force and dictionary attacks, including a look at the 'Beast' machine that tests billions of guesses a second. The description warns that the SHA512 advice in the video is out of date, so check current recommendations.
What people said
Recommends Michael · 2016-08 · Stack Overflow · on “What is the need for a strong password?”
The reason for a strong password is because simple passwords can be more easily "unhashed" than a strong one. The larger character sets used in the password, and the longer the password it is, the harder it is to crack. Take a look at these videos as there is way too much information to discuss here: [this video] [LINK]
Recommends fwr nr · 2017-08 · Stack Overflow · on “Decoding MD5 Hash into unicode”
Whites11 has mentioned brute-forcing, however take into account this is not 'Decoding' the hash. This is simply hashing common inputs and comparing the 2 hashes to see if they match, unless you have a set of common inputs that may actually match the hash its very unlikely you will get anywhere with it. Hashes are intentionally mono-directional, I can't think of why you would need to either you may need to rethink the logic of whatever project you're doing. To summarize, you can't decode a hash, this is intentional and that's why hashing algorithms exist. And brute-forcing is hashing common inputs to see if they match your hash. It's commonly used for password cracking etc. Done with common p
Recommends Frosty · 2019-01 · Stack Overflow · on “how to break password hash security”
Short answer is you can't Read up on this for some short infomration [LINK] At the moment password_hash() is pretty much the best that you can get as far as I'm aware, if you could break it from a simple "Stackoverflow" question , it wouldn't really be a good hash now would it. EDIT You can't break the hash BUT there is always BRUTE force attack , which means your password will be tested against all kinds of passwords and sooner or later it will guess it , unless your user has a good password or you have a system in place that locks the login form for lets say 1-2 mins before re-entering again This dude has a good video on it, its a decent watch [this video]
Cites Peter · 2017-10 · Information Security Stack Exchange · on “How secure is a password made up of three or four three-letter words?”
Also have a look at [this video] If you have access to the hash you can try billions of combinations per second with commodity hardware.
Cites ExecutionByFork · 2017-11 · Information Security Stack Exchange · on “Is it possible to be secure without a password manager?”
Intro I've actually been thinking on this a while myself, and I agree that using a password manager isn't ideal for password security. Because it introduces a single point of failure, which in my book is too great a risk. I don't want to entrust a third party with my security, or place the weight of security for all my accounts onto the strength of one password. Because you either need to store your passwords in the cloud which is potentially accessible to everyone, or keep local copies and run the risk of losing the data and access to all of your sites with it. The best solution I can come up with is one that has been mentioned in a few different answers already: using an algorithm to gener
Cites Sebastian Norr · 2018-09 · Information Security Stack Exchange · on “Is there any defense against this kind of attacks? (key comparison attack, or something)”
is there any defense against this kind of attack? [this video] I know someone who uses a password encryption hashing that generates the same length of keys as in this video and it makes me worried that those keys are equally vulnerable? (I don't know what kind of encryption hashing is used, nor do I want to know) *Does it help to increase the length of the encrypted hashed keys?* As I understand the attack: The attacker have somehow got a hold of the encrypted hashed keys, and also downloaded a big database of already cracked passwords & also downloaded some (or made own) rules for switching letters (a "mutator"). Then the attacker takes a solved password, mutates the password in all kinds of way
Cites Vasu Deo.S · 2019-05 · Information Security Stack Exchange · on “How is the strength of a key/Password determined”
I was reading about the Principle of Key Sizes and came across this table: [LINK] The deduction I made off this is that after a certain key size, increase in a single bit causes Time required for search to get doubled from the previous one. Then, I came across this video How to crack Passwords [this video] in which Prof. Pound tell's that your key strength is somewhat related to the character set of your password/Key. For Instance if my password is of 8 length and its character set is lowercase characters, then total attempts required to crack my password will be 26^8 = 208827064576 (character_set ^ keysize) (on the worst case). So I was wondering, whether the increase in Key_Size by bits, and th