Comment

Comment by pwg

You are still not understanding how these offline attacks work.

Assuming that was a hashed password (it is not), the way that these boxes crack it is they hash all possible passwords and test the resulting hash to see if it matches your hash. When they find an input that matches your hash, they have "decrypted your password".

What an offline attack does not do, which is where you are mixed up, is try to log into Facebook/Twitter/etc. over and over trying different possible passwords. Some other security breach reveals the stored hashes of user passwords, and that stolen list of password hashes is what gets run through these systems.

Then, when they find a batch of inputs that hash to some of the stolen hashes, then they start trying those both at the site of the breach, and at other sites, often to great success, because they never trip the "10 test attempts" (they have an input that works, first time) and due to the all too common reuse, learning a users craigslist (for example) password is often enough to gain access to their gmail account.

parent pwg 4 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton