Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

Yep. But they are hex strings that look like (are) hashes, and that's all I need to make the point. Next time I'll use /dev/urandom for that :)

In a real scenarios, use PBKDF2 or bcrypt!



sort by: page size:

What sort of hashes are those?

Edit: Nevermind... they seem to be passwords, not hashes. They look randomish though. Likely computer generated.


No, I'm talking about password hashing. Stuff like PBKDF2

These are password hashes, not the password it self.

Yes, and that's a good pattern. Just not for password hashes.

No they're not. I tried the following:

> irb

> require 'digest/sha1'

> Digest::SHA1.hexdigest 'my_password'

=> hash_string

Then I searched the file with the hash string and found my password. I really hope they don't also have the usernames somewhere.


There's still the question of why he would need the password hashes. Assuming he wanted the plaintext passwords to see if they are 'complex' and 'strong,' he would have a hard time telling that from the hashes.

5f4dcc3b5aa765d61d8327deb882cf99 and 05b28d17a7b6e7024b6e5d8cc43a8bf7: Which is a dictionary word and which is a string of punctuation? (I didn't salt :))


Yes, I was thinking more along the lines of hacking into something rather then decrypting a password hash.

There's a decent chance the passwords you found aren't the actual passwords either, considering how easy it is to generate collisions for the hash function.

He must be referring to them storing the passwords as unsalted SHA-1 hashes.

no

basically the hashing algorithm they use strips out certain information, which means that e.g.

"PaSSWord123" "pAsswORD123" "PaSSWord123 " etc

all hash to the same value, and so are equivalent.


Right; it's a cryptographic hash. Technically there's no such thing as a 'password hash', only password KDFs and their results, which are composed primarily by cryptographic hashes. I think the guy's point was that if you're going to build a password KDF, you might as well use a hash function that's less shitty than MD5 and SHA1.

That looks like they're using unsalted SHA-256 as a password derivation function? And they reimplemented every cryptographic primitive themselves?

I'll pass.


No, that's fine :) It wasn't clear to me from your original comment whether you were hashing passwords, apologies.

oh! I thought the whole thing was the password, apparently the first part is the hash

And if you read that file, you will read that they used DES for hashing. Reminds me of the LM hash. The LM hash generated two hashes using DES from two 7 byte parts of a 14 byte password. Basically they use each individual 7 byte part as a DES key to encrypt a fixed string. Repeat this twice for each 7 byte part, and concatenate the results, and you get the LM hash.

I don't think it's technically possible because they do display some of the letters.

They are just probably stored plain text or encrypted the password somewhere but I don't there is way to be a one way hash.

I'll be on just plain incompetence.


So, were these "passwords" stored as salted hashes?

I think he meant plaintext as opposed to a hash of the password.

You may be joking, but for the sake of other people who might read that and not know the reality of the situation:

That is not the case. Even just the length makes it pretty clear which hash is in use ( https://en.wikipedia.org/wiki/List_of_hash_functions ), and even assuming some crazy "security" scheme in use for storing them (hashing and then padding, or some such), someone with the hashes only has to figure out one password to figure out the procedure used. Given the high likelihood of there being "password" or "12345" hashed somewhere in there, that's not so hard.

next

Legal | privacy