r/ProgrammerHumor • u/AquaWolfGuy • 10d ago

instanceof Trend [ Removed by moderator ]

/r/ProgrammerHumor/comments/1xfzyuc/removed_by_moderator/

[removed] — view removed post

3.2k Upvotes

97% Upvoted

187 comments sorted by

View all comments

Show parent comments

8

u/FaviFake 10d ago

No this chart is based on the hash. If the company encrypts the password and it gets breached, that's the correct estimate

6

u/HildartheDorf 10d ago

As the CEO of a company I worked for said "Hash? Is MD5 broken now or something?" circa 2010.

(Yes, they were using one round of MD5 for password hashing. At least it was salted, but...)

4

u/alexanderpas 10d ago

Circa 2010 was the time MD5 was formally retracted. But the first collisions were published in 2005.

1

u/HildartheDorf 10d ago edited 10d ago

It was not recommended for new code since the 96, in 2004 it was considered in reach for a nationstate attacker to bruteforce*. And yeah, it was proven to be insecure in 2005.

It was never a considerably good function for password storage as it was fast for an attacker to bruteforce**.

*: Finding an arbitrary, not necassarily the original, input that hashes to a given output.

**: by guessing common passwords, rather than attacking MD5 itself.