Changing Forum Password

securityguy

amn wrote: »

Just searched for this as I got a password change notice. The fact that they are targeting users to change their passwords means either the passwords are stored in plain text, they are not using a one way hash or they are using unsalted hashes which are subject to rainbow table attacks. Either one isn't good......

Not necessarily. Suppose you have one million users, each with a distinct salt, using SHA1, which a few years ago would have been considered pretty good practice. Suppose you have one of these. At 63 billion hashes per second, you can check 63 thousand candidate passwords per user per second, or about 0.2 billion candidate passwords per user per hour. Renting a box like that for an hour would be a pretty good way to check your large website for vulnerable passwords.

I've just changed my password to 32 random characters drawn from the full printable ASCII range, which (unusually) MSE accepts. That's about 211 bits. The device above would need several billion, billion, billion times the life of the universe to crack it. That's probably OK :-)

Slowhand

amn wrote: »

Just searched for this as I got a password change notice. The fact that they are targeting users to change their passwords means either the passwords are stored in plain text, they are not using a one way hash or they are using unsalted hashes which are subject to rainbow table attacks. Either one isn't good......


It may be time to delete my account

How are you going to do that?

st999

What I want to know is, how do MSE know that my password is weak?

marleyboy

st999 wrote: »

What I want to know is, how do MSE know that my password is weak?

....I refer you to reading #post 5.

TheSaint_2

Just checked, good news, they do hash.
Bad news they use md5 which is the easiest hashing algorithm available to break. So it won't take much brute forcing to reverse the passwords out. I'm guessing its not salted either.

Ximian

MD5 :eek: Keeping passwords safe since 1992