The difference in speed between MD5 and something like bcrypt or Argon2 is massive. We’re talking orders of magnitude. That adds a layer of security – if hashing takes e.g. 1000 times longer than with md5, the 20 minutes to crack the least secure passwords suddenly turns into 14 days. Still not astronomical but a lot slower. The more secure algorithms also require more memory to run, leading to less effective parallelization.
Besides, MD5 is prone to collisions, which reduce the number of attacks needed. The attacker doesn’t need the real password, just one that hashes to the correct value.
While they did do a more sophisticated dictionary attack, they also talk about rainbow tables, which only work if the hashes are unsalted. A more modern approach with salted passwords is immune to rainbow table attacks. An actually modern approach with salted and peppered Argon2 hashes makes the kind of offline attack Kaspersky did unfeasible in the first place.
For some reason Kaspersky never bothered to point this out. I’d expect a reputable cybersecurity company like them to at least include one line that urges developers to make use of a modern approach and gives pointers as to what that might be. But I suppose “we recommend passwords to be salted, peppered, and hashed with Argon2i or Argon2id with a sufficiently high work factor” wouldn’t fit their narrative.
(I also just noticed that the advice part of Kaspersky’s article is littered with references to the password manager they sell. Yep, it’s an underhanded ad that just happens to contain some good security advice.)
Eh, sorry, but you cannot crack hashes. At best you can come up with a strong that generates the same hash, but finding the exact original value won’t happen, that’s not how hashes work, that is not how anything works.
Each hash output value in principle can have an infinity of different inouts that lead to that output. Because of that, hashes are a one way street
Having said that, are you telling me that a properly salted hash using a modern algorithm like argon2id, or just even plain sha256, can be “cracked” in 14 days? I’m going to go ahead and say “no”
In my comment, '“cracking” referred to finding a password that matches the hash. That’s common nomenclature. The found password doesn’t have to be the original password but it’s rather likely at the string lengths involved, especially since Kaspersky used a dictionary to back the attack.
Also, you wouldn’t use a hashing function where a large number of inputs of a usual password length turn into the same hash. That would just make all passwords weaker. The point of hashing a password is to store something that (ideally) uniquely matches the correct password but can’t be used to easily derive the password.
The factor of 1000 I gave was a very rough ballpark number. I couldn’t find any good comparison between the actual throughput of MD5 and bcrypt or Argon2. And yes, a single round of SHA256 would be cracked quickly; it’s much less work-intensive than Argon2 and even has dedicated hardware acceleration in modern CPUs. Argon2 with a high work factor is vastly more resistant than MD5 and SHA256.
Also, salting doesn’t protect against brute force and enhanced dictionary attacks. The salt is stored with the password so the attacker knows it. It only protects against rainbow tables. Pepper protects against offline cracking.
If you can generate an input which satisfies an md5 comparison which results in being able to authenticate with a system, then I think debating if that is a “crack” or not is purely semantic.
Although you are for sure technically right, I think any actually observed md5 collisions are with very large inputs, many orders of magnitudes longer than a password. The smallest input (first found, almost certainly) is almost certainly what the original password was.
The difference in speed between MD5 and something like bcrypt or Argon2 is massive. We’re talking orders of magnitude. That adds a layer of security – if hashing takes e.g. 1000 times longer than with md5, the 20 minutes to crack the least secure passwords suddenly turns into 14 days. Still not astronomical but a lot slower. The more secure algorithms also require more memory to run, leading to less effective parallelization.
Besides, MD5 is prone to collisions, which reduce the number of attacks needed. The attacker doesn’t need the real password, just one that hashes to the correct value.
While they did do a more sophisticated dictionary attack, they also talk about rainbow tables, which only work if the hashes are unsalted. A more modern approach with salted passwords is immune to rainbow table attacks. An actually modern approach with salted and peppered Argon2 hashes makes the kind of offline attack Kaspersky did unfeasible in the first place.
For some reason Kaspersky never bothered to point this out. I’d expect a reputable cybersecurity company like them to at least include one line that urges developers to make use of a modern approach and gives pointers as to what that might be. But I suppose “we recommend passwords to be salted, peppered, and hashed with Argon2i or Argon2id with a sufficiently high work factor” wouldn’t fit their narrative.
(I also just noticed that the advice part of Kaspersky’s article is littered with references to the password manager they sell. Yep, it’s an underhanded ad that just happens to contain some good security advice.)
Eh, sorry, but you cannot crack hashes. At best you can come up with a strong that generates the same hash, but finding the exact original value won’t happen, that’s not how hashes work, that is not how anything works.
Each hash output value in principle can have an infinity of different inouts that lead to that output. Because of that, hashes are a one way street
Having said that, are you telling me that a properly salted hash using a modern algorithm like argon2id, or just even plain sha256, can be “cracked” in 14 days? I’m going to go ahead and say “no”
In my comment, '“cracking” referred to finding a password that matches the hash. That’s common nomenclature. The found password doesn’t have to be the original password but it’s rather likely at the string lengths involved, especially since Kaspersky used a dictionary to back the attack.
Also, you wouldn’t use a hashing function where a large number of inputs of a usual password length turn into the same hash. That would just make all passwords weaker. The point of hashing a password is to store something that (ideally) uniquely matches the correct password but can’t be used to easily derive the password.
The factor of 1000 I gave was a very rough ballpark number. I couldn’t find any good comparison between the actual throughput of MD5 and bcrypt or Argon2. And yes, a single round of SHA256 would be cracked quickly; it’s much less work-intensive than Argon2 and even has dedicated hardware acceleration in modern CPUs. Argon2 with a high work factor is vastly more resistant than MD5 and SHA256.
Also, salting doesn’t protect against brute force and enhanced dictionary attacks. The salt is stored with the password so the attacker knows it. It only protects against rainbow tables. Pepper protects against offline cracking.
If you can generate an input which satisfies an md5 comparison which results in being able to authenticate with a system, then I think debating if that is a “crack” or not is purely semantic.
Although you are for sure technically right, I think any actually observed md5 collisions are with very large inputs, many orders of magnitudes longer than a password. The smallest input (first found, almost certainly) is almost certainly what the original password was.