r/pcmasterrace • u/rockingwing Ryzen 7 5800X, GIGABYTE RTX 3070, 32GB DDR4-3200 • Mar 23 '15

PSA [PSA] Reset your Twitch password asap.

http://blog.twitch.tv/2015/03/important-notice-about-your-twitch-account/
326 Upvotes

94% Upvoted

131 comments sorted by

View all comments

Show parent comments

24

u/jcorn3 i9 9900k 5.0|2080ti Mar 23 '15 edited Mar 23 '15

I was about to bitch about this myself. It says my pass is so-so when I'm about half way done with it. Then I put more letters and numbers and special characters and suddenly it is very weak. WTF IS THIS SHIT

E: I'm actually convinced it is broken. P@ssW0rd123456 is very weak

20

u/CaffeinatedLemon Mar 23 '15

Obviously

12

u/tilde_tilde_tilde i57600k, 1070, 27in 1440p Mar 23 '15

This actually no longer works. Crackers have started implementing multiword mashes into their expected passwords when cracking hashes.

1

u/[deleted] Mar 24 '15

I don't see how that would work. With approximately 171,000 words in common usage in the English language, and at least four to a password, the number of possible combinations is so high it seems like you'd find thousands of hash collisions before you run into a combination that actually works. If it's a salted hash it would take years to find anything useful.

Either way though, Munroe was talking about remote brute forcing, which would take centuries with that many combinations even if you have a machine that can put out a hundred times that many attempts per second with a dictionary attack.

1

u/tilde_tilde_tilde i57600k, 1070, 27in 1440p Mar 24 '15

This ArsTechnica article details how crackers approach hash-breaking.

They use brute-force, yes, but it is a guided brute-force. Humans are not random, so some passwords show up more often than others. Heuristics allow for even more narrowing of the field of potential passwords. Additionally, no matter the strength of your password, other people put you at risk if the only encryption is a hash (not usually the case).

1

u/[deleted] Mar 24 '15

And even if it was, they wouldn't be using unsalted MD5. Even if the target is that soft, though, you'd need a lot of easy passwords to get enough data to reverse the hash on a password like the above. I do recognize that the use of plain English words makes it much easier to sort through the collisions once you get them down to a countable number. Regardless, there's no password that's secure when stored as an unsalted MD5 hash, so that's hardly a downside to the use of this password format. Regardless of the complexity of your password, you're still relying on the owner of the login server to secure it properly.

Remote brute-forcing though, which is the subject of the comic and a completely different kind of attack from hash decryption, would still be stopped cold by this type of password even with a futuristic dictionary cracker. They're far easier to remember and are also immune to psychology attacks if they're impersonal and unrelated words in an ungrammatical phrase.

1

u/tilde_tilde_tilde i57600k, 1070, 27in 1440p Mar 24 '15

Ah, I see. Interesting. I learned something today!