Using Google To Crack MD5 Passwords

stern writes "A security researcher at Cambridge was trying to figure out the password used by somebody who had hacked his Web site. He tried running a dictionary through the encryption hash function; no dice. Then he pasted the hacker's encrypted password into Google, and voila — there was his answer. Conclusion? Use no password that any other human being has ever used, or is ever likely to use, for any purpose. I think."

Comments

Obligatory

[Anonymous Coward]

In Soviet Amerika, MD5 passwords crack you.

Re:Obligatory

[CrazyJim1]

What about the flip side: Using Crack to Google MD5 passwords?

Re:Salt

[eln]

I agree. Also, fry them in bacon fat and add pepper.

Dark Helmet

[Nate Fox]

So the combination is 827ccb0eea8a706c4c34a16891f84e7b. (lifts mask) That's the stupidest combination I've ever heard in my life. That's the kinda thing an idiot would have on his luggage.

Let me guess

[GroeFaZ]

The password was hunter2?

Re:Let me guess

[omnipresentbob]

What's with all the stars in your post?

Re:Salt

[eldavojohn]

And blackjack ... and hookers. In fact, forget the hashes!

Re:Salt

[SevenDigitUID]

That's not true. The user can generate a string with something like dd if=/dev/urandom bs=21 count=1|openssl base64 , store that string, and append it the the true password each time the log in. This has exactly the same results as the site correctly implementing salting. So what you are saying is the best defense is to use a crazy fucking password?

Re:I wouldn't be too alarmed.

[SevenDigitUID]

That is totally unfair to the wordpress developers. Just because they don't care doesn't mean they don't understand.

Re:RTFA

[eln]

You're correct. You have totally invalidated the points I brought up in my post. Good show.

Re:MD5 Lookup Site & Names

[PFAK]

He can't be much of a "security researcher" if someone hacked his own website.

My uneducated respose would be:

[newr00tic]

What about the flip side: Using Crack to Google MD5 passwords? 2343e9f361fea282776586d7056025db

Man, I need to change my password NOW.

[fo0bar]

Results 1 - 10 of about 101,000 for d41d8cd98f00b204e9800998ecf8427e. (0.04 seconds)

Re:Salt

[Anonymous Coward]

Ice building up on your sidewalk? Salting breaks it.

Re:Salt

[Jarjarthejedi]

Pretzels missing that unique flail? Salting solves it!
Need something else to put on those fries? Salt it!
Need to make your friend's drink taste awful? Salt is the way to go.

(Somewhere along the line we left the analogy department :P)

Re:MD5 Lookup Site & Names

[joNDoty]

Crap. From their "about" page:

Additionaly everytime when you enter a non-md5 hash string into the search field, the md5 result for that search strings gets stored in our database for future use. Thanks for warning me. I tested to see if my password was in there... it is now!!!

Re:Salt

[maxwell demon]

This is slashdot, we need a bad car analogy too. :P Your car rusting too slowly? Salt solves that! :-)

Re:Salt

[csteinle]

When a problem comes along, you must salt it.
Before the cream sits out too long, you must salt it.
When something's going wrong, you must salt it.

Now salt it! Salt it good!

Re:Credibility?

[neonsignal]

I looked these up on google, and they directed me to some slashdot page...

Re:Salt.. .so then develop

[davidsyes]

a rad ass custom mod chip that the user injects into the cerebral cortex and obdulla loongggatta and up down undah. The user then develops Tourettes Syndrome out the ass and has shit for brains now and only has to utter some crazy fucking ass phrase to seed a crazy fucking password in the solid-state gene-erator cuz they've gone fucking goddam crazy over that motherfuckin' chip in their ass and brain.

Crazy fucking luser. Crazy fucking assword. Crazy fuckin' whirled up world.

The above is the 1.0 tourettes pack, silver. Stainless-fucking-steel adds an additional language pack...