Hacker News Reader

Comment by pinko | Hacker News Reader

Holy mackerel:

  -------------------------
  \* Hash-Mode 2000 (STDOUT)
  -------------------------

  Speed.#1.........: 39068.9 GH/s (0.02ms) @ Accel:64 Loops:1024 Thr:512 Vec:1

What does 39 trillion (!) password hashes per second from a single GPU imply for password length/complexity these days?

View on HN

Mode 2000 is not a "real" mode and shouldn't be considered in terms of password security. It's just an empty kernel we use for producing candidates on stdout.

https://www.hivesystems.io/blog/are-your-passwords-in-the-gr...

an 8-character password with the usual upper/lower/special mix can be cracked in <1 hour by a single RTX 4090.

That's if hashed by md5, which really shouldn't be the case anymore. SHA-1 isn't much better, aiui, but would still be a more reasonable reference today - at least as far as I can see.

I wish it were scrypt, PBKDF2 or argon2id - but I realize those are still rare.

PBKDF2 should only be used if compliance with government requirements is a concern. While it can be adjusted to be arbitrarily difficult by changing the iterations it's still not memory intensive and can still be fairly easily cracked with a GPU (when compared to scrypt or argon2id).

Wonder how many sites are still using md5...

md5 was never supposed to even be used for passwords, it was designed to produce really fast checksums for files, a very bad property for a password hashing algorithm

Sure.

I wonder how many sites are still using md5...

Reply on news.ycombinator.com