Hacker News new | ask | show | jobs
by jackowayed 5709 days ago
If they're really just using 80GB on the SSD (as the linked-to article suggests), why not just use a server with 128GB of RAM and avoid writing to disk altogether?
4 comments

I'm not entirely sure which algorithm is used in WinXP for password hashing, but it might still be an LM hash, which has some security flaws. All lower-case characters are converted into upper case characters and the 14-byte password (cannot be longer) is divided into two 7-byte passwords, which can be cracked alone (sort of).

So, 300 billion passwords per second is still a very impressive load, but the keyspace for WinXP passwords is somewhat limited, which would also explain why 80 GB of rainbow tables are sufficient.

But correct me if I'm wrong.

Microsoft developed NTLM because LM sucked and made it the default in Windows XP. However, for backwards compatibility, it also hashed the passwords to LM, so, well, you can crack them just as easily.

From Vista onwards, I think, LM is no longer used.

True, but I suspect a 80GB SSD is a lot easier to afford for your common basement hacker than a box with 128GB of RAM.
23GB of ram on EC2 is 1.60 an hour. Spin up 10 for $16.00. I think most hackers can afford that and it gives them enough computing power to match an 80GB SSD, I would say.
I guess most hackers would rather do it at home ...
By roughly a factor of 10, not including the motherboard costs (since most boards don't support 128gb of ram).
This is a perfect example of what can you do with RAM that is one order of magnitude bigger than what you can normally afford in regular computers.

It would be interesting to see if the effort that is spent writing programs to load stuff from disk and avoiding seeks gets redirected to solve other problems.

Because Rainbow Tables only need to be written once, so you could mount the drive read only and get the benefits without the drawbacks.