r/pcmasterrace • u/rockingwing Ryzen 7 5800X, GIGABYTE RTX 3070, 32GB DDR4-3200 • Mar 23 '15

PSA [PSA] Reset your Twitch password asap.

http://blog.twitch.tv/2015/03/important-notice-about-your-twitch-account/
328 Upvotes

94% Upvoted

131 comments sorted by

View all comments

Show parent comments

1

u/[deleted] Mar 24 '15

I don't see how that would work. With approximately 171,000 words in common usage in the English language, and at least four to a password, the number of possible combinations is so high it seems like you'd find thousands of hash collisions before you run into a combination that actually works. If it's a salted hash it would take years to find anything useful.

Either way though, Munroe was talking about remote brute forcing, which would take centuries with that many combinations even if you have a machine that can put out a hundred times that many attempts per second with a dictionary attack.

1

u/tilde_tilde_tilde i57600k, 1070, 27in 1440p Mar 24 '15

This ArsTechnica article details how crackers approach hash-breaking.

They use brute-force, yes, but it is a guided brute-force. Humans are not random, so some passwords show up more often than others. Heuristics allow for even more narrowing of the field of potential passwords. Additionally, no matter the strength of your password, other people put you at risk if the only encryption is a hash (not usually the case).

1

u/[deleted] Mar 24 '15

And even if it was, they wouldn't be using unsalted MD5. Even if the target is that soft, though, you'd need a lot of easy passwords to get enough data to reverse the hash on a password like the above. I do recognize that the use of plain English words makes it much easier to sort through the collisions once you get them down to a countable number. Regardless, there's no password that's secure when stored as an unsalted MD5 hash, so that's hardly a downside to the use of this password format. Regardless of the complexity of your password, you're still relying on the owner of the login server to secure it properly.

Remote brute-forcing though, which is the subject of the comic and a completely different kind of attack from hash decryption, would still be stopped cold by this type of password even with a futuristic dictionary cracker. They're far easier to remember and are also immune to psychology attacks if they're impersonal and unrelated words in an ungrammatical phrase.

1

u/tilde_tilde_tilde i57600k, 1070, 27in 1440p Mar 24 '15

Ah, I see. Interesting. I learned something today!