benjojo.co.uk

benjojo posted 27 Oct 2025 18:16 +0000

You know, looking at the current rate that a single flagship GPU can do password hashing at, yeah, there are a whole classes of password hashing algros in the "megahash" range, and if you are using them (and the hash leaks) you are probably a bit fucked.

Unfortunately the megahash range is quite a lot of the ones that you shouldnt be using, but you know people are totally using anyway:

MD5
SHA.+
unix DES crypt()

but that is fine because you use a password manager right... riiiiight?

None of this is particular new news, I was just surprised to know a single card can do 6000 megahash/s of DES crypt() these days.

eta@gotosocial.i.eta.. replied 27 Oct 2025 18:18 +0000
in reply to: https://benjojo.co.uk/u/benjojo/h/Hh2x84Lx4LLV4htvB6

@benjojo new business model for OpenAI after the LLM stuff inevitably fails to work out

benjojo replied 27 Oct 2025 18:21 +0000
in reply to: https://gotosocial.i.eta.st/users/eta/statuses/01K8KEA5QNXGJ93WQX2922ASE0

@eta this is actually sam altmans next fund raising round strategy

taavi@wikis.world replied 27 Oct 2025 18:28 +0000
in reply to: https://benjojo.co.uk/u/benjojo/h/Y4CHl8Vxvtjh53yM4W

@benjojo @eta can't wait for a startup claiming their training corpus is better because they use this to find credentials for login-walled sites

grawity@social.treeh.. replied 27 Oct 2025 18:24 +0000
in reply to: https://benjojo.co.uk/u/benjojo/h/Hh2x84Lx4LLV4htvB6

@benjojo What's surprising to me is that apparently Glibc's $5$ is doing a better job than PBKDF2

benjojo replied 27 Oct 2025 18:35 +0000
in reply to: https://social.treehouse.systems/users/grawity/statuses/115447526258172226

@grawity I mean a lot of this is down to how hostile the algorithm is to a gpus architecture, some stuff is going to fare better than others, even if the complexity is not obviously better/worse from first glance