In my comment, '“cracking” referred to finding a password that matches the hash. That’s common nomenclature. The found password doesn’t have to be the original password but it’s rather likely at the string lengths involved, especially since Kaspersky used a dictionary to back the attack.

Also, you wouldn’t use a hashing function where a large number of inputs of a usual password length turn into the same hash. That would just make all passwords weaker. The point of hashing a password is to store something that (ideally) uniquely matches the correct password but can’t be used to easily derive the password.

The factor of 1000 I gave was a very rough ballpark number. I couldn’t find any good comparison between the actual throughput of MD5 and bcrypt or Argon2. And yes, a single round of SHA256 would be cracked quickly; it’s much less work-intensive than Argon2 and even has dedicated hardware acceleration in modern CPUs. Argon2 with a high work factor is vastly more resistant than MD5 and SHA256.

Also, salting doesn’t protect against brute force and enhanced dictionary attacks. The salt is stored with the password so the attacker knows it. It only protects against rainbow tables. Pepper protects against offline cracking.

The difference in speed between MD5 and something like bcrypt or Argon2 is massive. We’re talking orders of magnitude. That adds a layer of security – if hashing takes e.g. 1000 times longer than with md5, the 20 minutes to crack the least secure passwords suddenly turns into 14 days. Still not astronomical but a lot slower. The more secure algorithms also require more memory to run, leading to less effective parallelization.

Besides, MD5 is prone to collisions, which reduce the number of attacks needed. The attacker doesn’t need the real password, just one that hashes to the correct value.

While they did do a more sophisticated dictionary attack, they also talk about rainbow tables, which only work if the hashes are unsalted. A more modern approach with salted passwords is immune to rainbow table attacks. An actually modern approach with salted and peppered Argon2 hashes makes the kind of offline attack Kaspersky did unfeasible in the first place.

For some reason Kaspersky never bothered to point this out. I’d expect a reputable cybersecurity company like them to at least include one line that urges developers to make use of a modern approach and gives pointers as to what that might be. But I suppose “we recommend passwords to be salted, peppered, and hashed with Argon2i or Argon2id with a sufficiently high work factor” wouldn’t fit their narrative.

(I also just noticed that the advice part of Kaspersky’s article is littered with references to the password manager they sell. Yep, it’s an underhanded ad that just happens to contain some good security advice.)

I’d use at least one more: The one that unlocks your device shouldn’t be the one that unlocks your password manager. Other than that, yes. Use a password manager, let it generate per-service passwords for you, and make sure you have a backup plan.

For example, I use a KeePass database shared across my devices via a self-hosted NextCloud. Each of my devices plus the server effectively holds a backup copy so I’d have to lose all of my devices plus the server before my password database becomes inaccessible. Since the server lives in a datacenter it also serves as a remote backup.

If your password manager is SaaS, you might want to investigate how to protect yourself from scenarios like the service being down or you losing access to the account.

I think Gunner means a biometrically unlocked second factor like a Yubikey or a smartphone’s user attestation. Given how badly written the entire article is, I wouldn’t be confused if that’s what he originally said before they condensed his statement beyond comprehension.

So Kaspersky found out that MD5 passwords are unsafe. That’s literally 20 year old news. Actually, Kaspersky found out that brute-forcing MD5 on consumer-grade hardware has become slightly faster than two years ago, which makes me wonder if Captain Obvious’s secret identity is that of a Kaspersky cybersecurity expert.

El Reg concludes from this that we should ditch passwords, which they back up with the opinion of a second expert. This expert immediately tells them they’re wrong, that passwords are perfectly fine if used with MFA, and that a lack of public knowledge about basic cybersecurity is the real issue. They somehow treat this as him agreeing with them.

Actual technological alternatives to traditional password use (such as passkeys or password managers with per-site passwords) are mentioned only as an aside or not at all. It never occurred to El Reg or Kaspersky to mention that MD5 has been considered obsolete since the days of Internet Explorer 7 and that more secure hashes like bcrypt have been around since the late 90s. For that matter, the Kaspersky source talks about rainbow tables without using the word “salt” even once.

Finally they conclude with a call to action to “improve that user security stack”, arguing that passwords are inherently unsafe due to their “complex requirements and hashed storage”. That’s so deep into la-la land that I’m not even sure what it is they’re trying to say or who they’re even talking to.

That’s an amazingly badly written article.

What impresses me the most is that the Kaspersky article they’re talking about is just as asinine as El Reg’s confused stammering. The most sense I can make out of it is that they’re making a bad faith argument (“we can brute-force MD5’d passwords with a 5090 so you should use MFA”) because they’re trying to get nontechnical people to do the right thing and hope they can scare them into compliance if they bullshit hard enough.

Edit: I just noticed how often Kaspersky’s article refers to the own password manager they sell. So their bad faith argument is really just in service of an ad that happens to contain some decent security advice.

“We could fix this but some people out there still like Windows and we’re committed to putting an end to that nonsense.”

I said I can respect it, not that it’s good. It feels like a deliberate attempt to torpedo the revival of a series that really didn’t need to be revived. That’s what I can respect, not the movie on its own merits.

I can respect the fourth one. Sure, it was a terrible movie but it feels like a deliberate piss take on the idea of reviving the franchise. And I can respect that.

Go with the times. Make a version where they fall into The Receiver’s gaping colon for 10,000 years. Make Hampster Dance start playing after 5,000 years just to fuck with them.

So they’ll make you stateless and ship you off to whichever country is willing to provide a terminal storage facility for politically undesirable former citizens. People who build concentration camps don’t particularly care about details like whether an “immigrant” is a citizen born to citizens.

Here’s one for a TV show.

In 2022, a crack quality assurance team was made redundant by a CTO for a botched product launch they didn’t commit.

These men promptly escaped from a maximally unstable job market to the LinkedIn underground.

Today, still wanted by recruiters, they survive as soldiers of fortune.

If you have a broken codebase, if no one else can help, and if you can find them, maybe you can hire the QA-team.

Man, Crank 3 is a lot worse than the first two.

The AfD reflexively gave a statement that any suspicions against their MPs are completely unwarranted.

Or, even worse, the video shows them one word at a time.

Jumping Cubes is the kind of game that works really well on a PC and has super simple rules but is absolute hell in real life.

That game on the Risk board was fun, though. IIRC North America in particular tended to have those terrible chain reactions that just kept going and going.

You know I know that you’re not telling the truth.

The logic behind it is that a smartphone-bound passkey represents two factors of authentication: what you have (the phone) and who you are (the fingerprint used to unlock the phone’s passkey store).

Anything on a PC is easily copied and can only ever be safely assumed to represent one factor: what you know (the password to unlock your password manager). Thus the benefit of getting a two-factor authentication in one convenient step falls away.

Of course it’s still super annoying, especially if you don’t really trust your smartphone OS vendor and use a portable password manager already.

I also often see implementations where there’s a first step where you have to select how to log in. It’s an extra click but very clear (and usually one of the options is some form of SSO where that one click fully logs you in if you already have a session open).

Also, according to certain “news” publications and an army of totally legitimate people on the internet, he’s as incompetent as he’s evil and he’s singlehandedly responsible for every single problem anyone in Germany has had for the last 20 years.

My company uses Entra ID (or whatever they’ve renamed it to this week) and it’s a pretty common sight in our login flow. I think our SharePoint instance does it so it should be something MS does.

Of course it all depends on w how the company configures it.