[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 Nov 2015 08:45:36 -0900
From: Royce Williams <royce@...ho.org>
To: john-users@...ts.openwall.com
Subject: Re: password cracking as a subset of hash searching
On Fri, Nov 20, 2015 at 8:40 AM, Rich Rumble <richrumble@...il.com> wrote:
>
> On Fri, Nov 20, 2015 at 2:49 AM, magnum <john.magnum@...hmail.com> wrote:
>
> > On 2015-11-20 08:23, Frank Dittrich wrote:
> >
> >> On 11/20/2015 08:09 AM, Royce Williams wrote:
> >>
> >>> In this blog post:
> >>>
> >>>
> >>> http://roycebits.blogspot.com/2015/10/hash-filtering-more-than-vanity.html
> >>>
> >>> ... I argue that password cracking frameworks should start to
> >>> incorporate searching for partial matches of hashes -- vanity hashes,
> >>> partial collisions, hashes that mask specific masks, etc.
> >>>
> >> I can see a vanity tripcode, even slimmer a vanity BtC wallet, those are
> visible to others, but your own hash or salt, even for older folks like me
> have zero appeal. A vanity PGP key... ehhh who would notice. Sounds cool on
> paper (or does it?), get's missed by 99.99999999 of the people who would
> ever see it.
That's why I titled the post "more than just vanity." :) I believe
that there are other uses. Partial hash matches are currently being
used in multiple previous and current CTFs. I believe that this is
because partial hash matches have real-world value, some of which may
not yet be readily apparent.
> >>> In other words, I see password cracking (searching for hashes that
> >>> exactly match known hashes) as part of a larger class of activities
> >>> (searching for hashes with specific properties), and see potential for
> >>> cross-pollination with related work that would ultimately benefit the
> >>> project. I point out some recent examples in the post.
> >>
> >> I would want my password to be memorable long before I'd want my hash/key
> to be :)
> -rich
Me, too - but memorability is only one use case.
Royce
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
