80,000 Plaintext Passwords: An Open Source Love Story in Three Acts
summary
A white‑hat attack recovers 80,000 passwords in 87 seconds using common tools like hash cat and large wordlists, showing MD5/SHA hashes and global salts fail; switching users to bcrypt-ruby with an increased cost parameter makes brute‑forcing impractical (an attack that took 87s now estimates ~84,000 years), conversion runs live with modest CPU doubling, and a cross‑compile dev box (rate compiler dev box) plus upstream maintenance of bcrypt‑ruby actually fixes distribution and build pain.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:43Who am I
- 1:48Layers of Security
- 2:19Plaintext Encryption
- 4:47Reversible Hashing
- 13:02Adaptive Cost
- 18:54Bcrypt Boobie
- 20:55Rails Dev Box
- 21:49The Climax
- 22:50Conclusion
related talks
29m80,000 Plaintext Passwords: An Open Source Love Story in 3 Acts
31m680,000 Plaintext Passwords: An Open Source Love Story in Three Acts
34m80,00 Plaintext Passwords
40mLive autopsy of a password: lessons learnt cracking secrets
36mThe Slower the Stronger: A Story of Password Hash Migration
27mKeeping passwords safe in 2017
42mPassword Hashing
30mhunter2: A Symphony of Password Horror