Comment on 16 Billion Apple, Facebook, Google And Other Passwords Leaked — Act Now
orclev@lemmy.world 5 days agoHashes can be brute forced, it’s just normally too expensive to do so for any reasonably complex password. If you’re using “password123” as your password even a hashed password is easily cracked (salting and peppering can help make this more difficult, although still not impossible).
tartarin@reddthat.com 5 days ago
I’m perfectly aware anything can be brute forced and that’s why it doesn’t worth to mention. Now, the amount of resources required to brute force a hashed password has nothing to do with the complexity of the password. No matter what the password is, the hash will have a fixed length and appear as a random sequence of bytes. Otherwise you are not doing it properly.
The complexity of the password has something to do with guessing the password from dictionary or known most common passwords.
orclev@lemmy.world 5 days ago
Kind of both. The modern way of brute forcing is to just hash the 100,000 most common passwords, previously leaked passwords, and minor permutations of all of the above. It’s computationally and space intensive, but for a determined attacker entirely doable on modern hardware. That’s why complexity matters, because it’s not a simple iteration through every possible permutation, but a targeted search through a known password list.
tartarin@reddthat.com 4 days ago
That’s why it’s not brute force anymore.