-19
16 Billion Apple, Facebook, Google And Other Passwords Leaked — Act Now (www.forbes.com)
submitted 1 year ago by to c/technology@lemmy.world
9 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 1 year ago (3 children)

Hashes can be brute forced, it's just normally too expensive to do so for any reasonably complex password. If you're using "password123" as your password even a hashed password is easily cracked (salting and peppering can help make this more difficult, although still not impossible).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 1 year ago (2 children)

    I'm perfectly aware anything can be brute forced and that's why it doesn't worth to mention. Now, the amount of resources required to brute force a hashed password has nothing to do with the complexity of the password. No matter what the password is, the hash will have a fixed length and appear as a random sequence of bytes. Otherwise you are not doing it properly.

    The complexity of the password has something to do with guessing the password from dictionary or known most common passwords.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 year ago* (1 child)

    Kind of both. The modern way of brute forcing is to just hash the 100,000 or so most common passwords, previously leaked passwords, and minor permutations of all of the above. It's computationally and space intensive, but for a determined attacker entirely doable on modern hardware. That's why complexity matters, because it's not a simple iteration through every possible permutation, but a targeted search through a known password list.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •