Hacker News new | ask | show | jobs
by raverbashing 4668 days ago
""jdtwbv" hashed using scrypt is stronger than "H.*W8Jz&r3" hashed using MD5"

Is it? I'm not sure.

for the first one you're using lowercase letters (and digits, I'm giving you that 'free')

For the first one we have 36^6 For the second one (all printables) 100^9

Relation between them: ~ 459,393,658. If you're saying scrypt is 100M times better, in this case the second one is safer

And the relation is important but less as computers get faster. Option B may take 1Mi times as long as Option A but if Option A takes 1 microsecond, there goes your Option B as well
2 comments
cperciva 4668 days ago
If you're saying scrypt is 100M times better

Oops, you're right, I got the math wrong when I looked at the table in my paper. I should have said that scrypt can be over 100,000,000,000 times stronger. ;-)

link
danielweber 4668 days ago
People have built huge rainbow tables of MD5 hashes.

I don't really keep up with that game (like WoW, it seems like a fun game, but only if you are willing to put in a lot of your time), but I think the current limit is somewhere around 8 or 9 characters if you are pulling from all printables, meaning that "H.*W8Jz&r3" with MD5 is probably not breakable right now.

Take off two characters, or wait 3 years, and it probably will be.

link
consultant23522 4667 days ago
My understanding, and I'm sure that someone else will correct me, is that with MD5 rainbow tables it's not so much that someone will get your password as they will get something that hashes to the same value. More than likely this will be your password, but sometimes not. The point is that it doesn't matter if your password is 25 characters long.. if there's a 5 character password that hashes to the same value they could log in with it.
link
danielweber 4667 days ago
While it's possible to make MD5 collisions, finding something that hashes to the same thing as a hash of my short password is essentially impossible.

In fact, collisions on short passwords are harder than collisions on long passwords. The space of all MD5 outputs is way bigger than the space of 12-character passwords.

link