• 0 Posts
  • 38 Comments
Joined 2 years ago
cake
Cake day: June 25th, 2024

help-circle

  • I think the specific hash algorithm used doesn’t matter much, except that MD5 is quite fast to calculate. A modern hash algorithm would buy some time by being more expensive computationally, but wouldn’t change much otherwise. From how I understand the article, they effectively did a sophisticated dictionary attack on the passwords in the database, not brute force attacks on individual hashes. Probably starting with all the known common passwords and then continuing with some generator based on common password patterns. Otherwise I couldn’t explain how they cracked 48% of the passwords in under 60 seconds and needed the remainder of an hour for just another 12%.

    Regardless, that’s no excuse for still using MD5 hashes today. The problem is that a sizeable chunk of IT professionals have no fucking clue what they’re doing. They might have heard that storing passwords as plain text is a bad idea, so they use the first hash algorithm they come across which happens to be MD5, unsalted of course. Unittests pass, everyone’s happy, software gets shipped, black hats are happy.


















  • A major version of 0 isn’t necessarily any statement regarding the projects maturity, it can also be a hack with semantic versioning. Normally, any change that is not fully backwards compatible requires you to increment the major version, but if the major version is 0, you may only increase the minor version. Because of this, many projects stay at the 0.x.y versions, so they don’t need to release version 2.0.0, 3.0.0, 4.0.0 and so on just because of minor but breaking changes as many users might expect significant new features from that version steps.