Passwords should be paired with a second factor, preferably biometric, said Gunner, because it’s the most difficult for hackers to bypass.

I think this is a pretty naive risk analysis. Hackers cracking my lemmy password is the least of my concerns. Having my biometric data leaked is one of my highest ones.

So Kaspersky found out that MD5 passwords are unsafe. That's literally 20 year old news. Actually, Kaspersky found out that brute-forcing MD5 on consumer-grade hardware has become slightly faster than two years ago, which makes me wonder if Captain Obvious's secret identity is that of a Kaspersky cybersecurity expert.

El Reg concludes from this that we should ditch passwords, which they back up with the opinion of a second expert. This expert immediately tells them they're wrong, that passwords are perfectly fine if used with MFA, and that a lack of public knowledge about basic cybersecurity is the real issue. They somehow treat this as him agreeing with them.

Actual technological alternatives to traditional password use (such as passkeys or password managers with per-site passwords) are mentioned only as an aside or not at all. It never occurred to El Reg or Kaspersky to mention that MD5 has been considered obsolete since the days of Internet Explorer 7 and that more secure hashes like bcrypt have been around since the late 90s. For that matter, the Kaspersky source talks about rainbow tables without using the word "salt" even once.

Finally they conclude with a call to action to "improve that user security stack", arguing that passwords are inherently unsafe due to their "complex requirements and hashed storage". That's so deep into la-la land that I'm not even sure what it is they're trying to say or who they're even talking to.

That's an amazingly badly written article.

What impresses me the most is that the Kaspersky article they're talking about is just as asinine as El Reg's confused stammering. The most sense I can make out of it is that they're making a bad faith argument ("we can brute-force MD5'd passwords with a 5090 so you should use MFA") because they're trying to get nontechnical people to do the right thing and hope they can scare them into compliance if they bullshit hard enough.

Edit: I just noticed how often Kaspersky's article refers to the own password manager they sell. So their bad faith argument is really just in service of an ad that happens to contain some decent security advice.

A simple workaround is to just use one of the other 40%.

I mean, yeah. MD5 blows for this. It's not like programs recommend you keep an MD5 hash of people's passwords on disk or in environment variables, right Perforce?

The amount of websites I'm forced to create accounts on for various mandatory crap that insist on a short password (12-16 characters seems common) is embarrassing, and causing a large part of this issue.

Wow this article is kinda shit. MD5 was on the chopping block for password hashing over 20 years ago. It's so seriously broken that if someone is using it they deserve to get bludgeoned to death with a Model M keyboard. We have purpose built solutions just for password hashing.

The only thing the fine bad article sorta got right was two factor. I say kinda because biometrics (something you are) isn't that great of a second factor. Mainly because you can't change it. Also, it's a fuzzy match rather than a hard match. It can be acceptable to use locally and where all the information stays locally AND there is sufficient hardware based security where said biometrics isn't going to get off the device.

Finally, there was no mention of any kind of physical token based factor (something you have). Which pairs well with password, passphrase, or any other "something you know" factor.

Hasn't md5 been cracked for like 2 decades? Now if they could Crack like aes-256 in under an hour this would be a different conversation.

A private security company ask people to give valuable biometric data. No reason to trust what they said, furthermore without step to reproduce.

However from this article :

The professor noted that, in many cases, users aren’t told how to create a good modern password, and in other cases, sites simply don’t enforce adequate password requirements to make passwords secure, to the degree that they can be made so.

Maybe a shall do more crypto-party instead of send our passwords online, giving our phone numbers or biometrics.

In the past, I was a user of bad passwords. Anything I didn't care about I'd just pick an easy one. Probably 60% of the passwords I created, I did not care at all about and would've been perfectly okay with someone cracking them if they'd wanted to.

I have since changed my ways and use good passwords now. I want nothing to do with biometric data collection and hope that it never becomes normal. Everyone without some kind of brain problems that prevent it should create and remember one good password — the one for their password manager.

An hour? Wtf? I swear that 5+years ago I saw a tool that would trivially modify any file by appending MD5-sum-length bytes to match any desired MD5, within a fraction of a second.

Were the hashes salted?

MD5 hashes have been crackable on consumer hardware for like 20 years.

That's why my bank does not hash the password. They directly send me plain text password over SMS. It is secure that way.

That's why they need a little bit of seasoning. Some salt would do the trick. At least it would help with a dictionary/rainbow table based attack anyway

We ran a database of password leaks through a Caesar cypher and you'll never guess how easy they were to break!

No one uses MD5 for password security anyway

Can someone ELI5 for me?

We've known this for more than a decade and its only gotten faster. If people are still using MD5 for secret hashing at this point they have no idea what they are doing or horrible bosses.

I think I gather from this that predictable strings are sort of reversible to hashes.

For stuff like SQL databases, I suppose I would personally would generate completely random passwords locally on my PC.

A proper hashing function is the one that takes time.