80,00 Plaintext Passwords
summary
A white‑hat extraction finds 80,000 passwords in 87 seconds by pulling a customer dump and cracking hashes with hashcat and a 25M wordlist; many “complex” passwords fall to keyboard patterns and leetspeak rules. Replacing global SHA hashes with per‑password bcrypt (adjusting the cost) turns that 87‑second attack into roughly 84,000 years on current hardware. Work also goes into maintaining bcrypt-ruby with precompiled binaries and a rake-compiler devbox and the bcrypt gem’s Ruby API quirks (== override) are noted.
AI-written summary · about
chapters (10)
- 0:00Start
- 2:06I am not a Security Expert
- 3:11Layers
- 6:06Encryption is reversible
- 6:55Hashing is deterministic (but not obvious)
- 8:58Defeating the Rainbow
- 10:26Proof of Concept
- 15:49Adaptive Cost
- 27:59Find your Luis
- 29:032. Distribute a dev box
related talks
25m80,000 Plaintext Passwords: An Open Source Love Story in Three Acts
29m80,000 Plaintext Passwords: An Open Source Love Story in 3 Acts
31m680,000 Plaintext Passwords: An Open Source Love Story in Three Acts
40mLive autopsy of a password: lessons learnt cracking secrets
31mBreaking Bad (Passwords)
40mFantastic Passwords and Where to Find Them
36mThe Slower the Stronger: A Story of Password Hash Migration
42mPassword Hashing