Hackers crack 16-character passwords in less than an HOUR

**nexcom28** · 05-28-2013, 12:52 PM

350 billion guesses per second...

**Intrinsic** · 05-28-2013, 12:54 PM

I heard the safest passwords were four word combos with dashes (??) and would take forever to crack

example: take-fish-dirt-reed
example: sdfk-fjsd-weij-akji

**shake** · 05-28-2013, 12:56 PM

Wow that's a lot of GPU power.

**_Richard_** · 05-28-2013, 12:57 PM

damn they're coming along nicely

**ajrocks** · 05-28-2013, 12:57 PM

most systems have brute force prevention in place to prevent this sort of stuff. But if they came in using a bot net you would be in trouble until you caught it.

**shake** · 05-28-2013, 12:57 PM

Originally posted by Intrinsic

I heard the safest passwords were four word combos with dashes (??) and would take forever to crack

example: take-fish-dirt-reed
example: sdfk-fjsd-weij-akji

Pass phrases were all the rage for a bit, but I think even those would be crackable, unless they are very long. Pretty soon we'll have to use a USB drive with a megabyte size password or something.

**seeandsee** · 05-28-2013, 12:59 PM

but this will work to unpack and unprotect files, to access your NET accounts, he can't do it via bruteforce, server and program will just take it down...

**nexcom28** · 05-28-2013, 12:59 PM

Originally posted by Intrinsic

I heard the safest passwords were four word combos with dashes (??) and would take forever to crack

example: take-fish-dirt-reed
example: sdfk-fjsd-weij-akji

I doubt that would take much working out.

1. You have x4 dictionary words
2. Just putting 4 dashes in aint gonna fool no-one.

I think site owners really need to make their sites secure against multiple login attempts rather than getting us to remember 5%6Yy*5$fdd1$8>KKhJo)o or some such shit.

**Klen** · 05-28-2013, 01:30 PM

Originally posted by nexcom28

I doubt that would take much working out.

1. You have x4 dictionary words
2. Just putting 4 dashes in aint gonna fool no-one.

I think site owners really need to make their sites secure against multiple login attempts rather than getting us to remember 5%6Yy*5$fdd1$8>KKhJo)o or some such shit.

Actualy it's better to have password like "iliketurtlesandsausegeswithcream12345"which is long enough yet still easy to remember.

Beside as longest you have some sort of bruteforce protection things like this dont mean much.

**edgeprod** · 05-28-2013, 01:45 PM

**Lichen** · 05-28-2013, 02:15 PM

Originally posted by Intrinsic

I heard the safest passwords were four word combos with dashes (??) and would take forever to crack

example: take-fish-dirt-reed
example: sdfk-fjsd-weij-akji

Include numbers, special characters and uppercase/lowercase. Like this:

71#Testpassword

**spiederman** · 05-28-2013, 02:22 PM

surrentlysober is pretty safe with Icunta4rdapassw0rd

**grumpy** · 05-28-2013, 02:30 PM

great server if it allows you 3.5 billion tries a second.

**nexcom28** · 05-28-2013, 02:35 PM

Originally posted by grumpy

great server if it allows you 3.5 billion tries a second.

I could do with it for my sites

**_Richard_** · 05-28-2013, 02:39 PM

Originally posted by edgeprod

**pornmasta** · 05-28-2013, 02:44 PM

The example, Ars Technica use is: hashing the password 'arstechnica' produced the hash c915e95033e8c69ada58eb784a98b2ed

Read more: http://www.dailymail.co.uk/sciencete...#ixzz2Ud94lCOi

md5 hashing... this problem is not new

**edgeprod** · 05-28-2013, 03:01 PM

Originally posted by grumpy

great server if it allows you 3.5 billion tries a second.

Likely, the crackers had the hashes available, and were cracking against the hashes, versus against a live server.

**Grapesoda** · 05-28-2013, 04:05 PM

Originally posted by nexcom28

I doubt that would take much working out.

1. You have x4 dictionary words
2. Just putting 4 dashes in aint gonna fool no-one.

I think site owners really need to make their sites secure against multiple login attempts rather than getting us to remember 5%6Yy*5$fdd1$8>KKhJo)o or some such shit.

I use passwords like this: `#LG\`yf8tyLkx5([Rd9RA ....the only issue is some sites won't allow special characters...

**The Heron** · 05-28-2013, 07:14 PM

I don't use a password, just leave it blank they can guess all they want they'll never solve it!!

**rowan** · 05-28-2013, 07:49 PM

Did any of you guys actually read the article? correcthorsebatterystaple is a little harder to crack, but not impossible. They use custom dictionaries that brute force multiple WORDS as well as multiple characters.

**Basileus** · 05-28-2013, 09:43 PM

Because only retards use md5. If it was SHA512 we'd never see this article ;)

**Chosen** · 05-28-2013, 10:34 PM

Originally posted by spiederman

surrentlysober is pretty safe with Icunta4rdapassw0rd

**pimpmaster9000** · 05-29-2013, 12:21 AM

if your system is open to brute force then you pretty much deserve what happens...

**Markul** · 05-29-2013, 12:34 AM

Originally posted by edgeprod

That is awesome

**just a punk** · 05-29-2013, 01:58 AM

Originally posted by ajrocks

most systems have brute force prevention in place to prevent this sort of stuff. But if they came in using a bot net you would be in trouble until you caught it.

Please read carefully. Whey did that on password hashes.

**Barry-xlovecam** · 05-29-2013, 06:32 AM

Originally posted by Basileus

Because only retards use md5. If it was SHA512 we'd never see this article ;)

QFT

**edgeprod** · 05-29-2013, 09:51 AM

Originally posted by rowan

Did any of you guys actually read the article? correcthorsebatterystaple is a little harder to crack, but not impossible. They use custom dictionaries that brute force multiple WORDS as well as multiple characters.

Against a hash .. which is an unlikely scenario in most cases. Against a weak remote web service, at 1,000/hr, I'm comfortable with 550 years of security versus 3 days.

**KillerK** · 05-29-2013, 10:35 AM

I've started using password as my password, I figure it's so common nobody would code a cracker to waste testing it.

**brassmonkey** · 05-29-2013, 10:42 AM

ok thanx 4 the stress

**x-rate** · 05-29-2013, 11:45 AM

I use 'wrong' as password so when I don't type it properly site tell me: your password is wrong

**biskoppen** · 05-29-2013, 01:45 PM

Originally posted by x-rate

I use 'wrong' as password so when I don't type it properly site tell me: your password is wrong

You should change it to incorrect, I hear it's the new thing

**RyuLion** · 05-29-2013, 02:07 PM

Originally posted by x-rate

I use 'wrong' as password so when I don't type it properly site tell me: your password is wrong

Originally posted by Grapesoda

I use passwords like this: `#LG\`yf8tyLkx5([Rd9RA ....the only issue is some sites won't allow special characters...

**ladida** · 05-29-2013, 03:00 PM

Originally posted by ajrocks

most systems have brute force prevention in place to prevent this sort of stuff. But if they came in using a bot net you would be in trouble until you caught it.

You did not really say this...

Anyway, md5 is so 1990, not even sure who hashes with md5 anymore.

**blackmonsters** · 05-29-2013, 04:25 PM

Just buy a cheap server. A billion request will crash the motherfucker.

Hackers crack 16-character passwords in less than an HOUR

Hackers crack 16-character passwords in less than an HOUR

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment