60% of MD5 Password Hashes Are Crackable In Under an Hour (theregister.com) 10
In honor of World Password Day, Kaspersky researchers revisited their study on the crackability of real-world passwords and found that 60% of MD5-hashed passwords could be cracked in under an hour with a single Nvidia RTX 5090, and 48% could be cracked in under a minute. "The bottom line is that passwords protected only by fast hashing algorithms such as MD5 are no longer safe if attackers obtain them in a data breach," reports The Register. From the report: Much of the reason password hashes have become so easy to crack is password predictability. Per Kaspersky, its analysis of more than 200 million exposed passwords revealed common patterns that attackers can use to optimize cracking algorithms, significantly reducing the time needed to guess the character combinations that grant access to target accounts.
In case you're wondering whether there's a trend to compare this to, Kaspersky ran a prior iteration of this study in 2024, and bad news: Passwords are actually a bit easier to crack in 2026 than they were a couple of years ago. Not by much, mind you -- only a few percent -- but it's still a move in the wrong direction. "Attackers owe this boost in speed to graphics processors, which grow more powerful every year," Kaspersky explained. "Unfortunately, passwords remain as weak as ever." "This World Password Day, the main message ought not to be to the users, who often have no choice but to use passwords anyway, but to the sites and providers that are requiring them to do so," said senior IEEE member and University of Nottingham cybersecurity professor Steven Furnell. His advice is that providers need to modernize their login systems and enforce stronger protections, because users are often stuck with whatever security options they're given.
In case you're wondering whether there's a trend to compare this to, Kaspersky ran a prior iteration of this study in 2024, and bad news: Passwords are actually a bit easier to crack in 2026 than they were a couple of years ago. Not by much, mind you -- only a few percent -- but it's still a move in the wrong direction. "Attackers owe this boost in speed to graphics processors, which grow more powerful every year," Kaspersky explained. "Unfortunately, passwords remain as weak as ever." "This World Password Day, the main message ought not to be to the users, who often have no choice but to use passwords anyway, but to the sites and providers that are requiring them to do so," said senior IEEE member and University of Nottingham cybersecurity professor Steven Furnell. His advice is that providers need to modernize their login systems and enforce stronger protections, because users are often stuck with whatever security options they're given.
Rethinking our approach (Score:2)
The "requirements" for a secure passwords will keep trending up such that harassing users to write War and Peace to log in is a dead end.
The password server should be in a special box that throttles requests. It would have a very limited and primitive interface to the outside world; technicians would have to physically unlock it to service it. There would be a mirror server for a backup.
That way no hacker can run gajillion retries on a password without swiping the actual box.
Re: (Score:2)
Great, so now attackers can easily DoS your login system.
Besides, most password-strength analyses assume the attacker has full access to the file of encrypted passwords.
However, nobody in their right mind will store a password by simply storing the MD5 sum of the password. It will be salted and stored with a large number of rounds of a more secure hashing function which makes the crackers' job much harder.
You don't need to write "War and Peace". I will generate a perfectly secure, practically-uncrac
Re: (Score:1)
> so now attackers can easily DoS your login system.
What keeps them for doing that with a traditional system? Even a traditional login screen should be throttled.
> Which is why you store it in a password-keeper
Another vector for hacking.
Re: (Score:2)
A traditional login system throttles based on the endpoint (ie, the IP address or a specific browser cookie.) I read your setup as a global throttle. If that's not what you meant, then fine; I'll explain why throttling doesn't work: Attackers have armies of machines at their disposal as part of a botnet, and they can distribute their cracking attempts so it doesn't look like any one particular machine is trying too often.
And if you lock an account after a certain number of incorrect guesses... we're bac
Re: (Score:2)
Almost all replacements for passwords are not implemented as a way to prove you have access. They are implemented in a way that forces you to uniquely identify as a specific human being. There is a difference. I will continue to use passwords until there is no other option because a password does not compromise my identity or tie my account to a named human.
Re: (Score:2)
In general, the newer methods are ways to associate you with controlled access to known device or keystore. The authentication and identification is against that account. This shouldn't be confused with using social login, which big identity providers being more likely to be on the more cutting edge of offering those methods. But if a independent provider let you use a passkey that you store in an independent password manager or lets you use a second factor with TOTP those don't identify you any more than y
Re: (Score:2)
When I ran my company, that's exactly what we did. We picked people's passwords for them and did not let them change the password. If they wanted to change it, then we generated a different random one for them.
My rationale was that if we got hacked and the passwords were leaked, at least those passwords were very unlikely to be useful on any other sites used by our customers. Unless they loved our password so much they reused it, I guess... but that's not too likely.
Kaspersky Sales (Score:2)
Here's the real backing article from Kaspersky [kaspersky.com]. Shame that there is no mention that individual salts before hashing have been best practices for many, many years. They of course have a vested interest in scare tactics to sell their password manager product.
That said multi factor auth, long pass phrases, and passkeys are definitely more secure and good advice. But something like Bitwarden might be a better choice.
Unloseable passwords (Score:2)
Facial Recognition is a problem because one's face is always there and can be photographed for later break-ins to any secured device. It stops opportunistic thieves, not a planned robbery. Similarly, PassKeys are really passwords the user never touches: This makes the phone the point of weakness, as there's no access when the phone is missing, and whoever has the phone has cont