# Think your password is secure?
**URL:** https://forums.yoyoexpert.com/t/think-your-password-is-secure/81414
**Category:** Unrelated Discussion
**Created:** [August 3, 2016, 5:57am UTC](https://forums.yoyoexpert.com/t/think-your-password-is-secure/81414 "2016-08-03T05:57:18Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@jhb8426](https://forums.yoyoexpert.com/u/jhb8426)
#### Post date: [August 3, 2016, 5:57am UTC](https://forums.yoyoexpert.com/t/think-your-password-is-secure/81414/1 "2016-08-03T05:57:18Z")
Think again…
[Why passwords have never been weaker—and crackers have never been stronger](http://arstechnica.com/security/2012/08/passwords-under-assault/)
[Anatomy of a hack: How crackers ransack passwords like “qeadzcwrsfxv1331”](http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/)
---
### Author:  [@ckwiz911](https://forums.yoyoexpert.com/u/ckwiz911)
#### Post date: [August 4, 2016, 3:28am UTC](https://forums.yoyoexpert.com/t/think-your-password-is-secure/81414/2 "2016-08-04T03:28:06Z")
Interesting. Makes me want to use a PW manager. I guess it would be worth it to take the time to get familiar with Dropbox. I hate to admit how many times I reuse the same password. Anyway, thanks for posting this. It was a long read, but it opened my eyes.
Peace… - Woody
---
### Author:  [@Yummy](https://forums.yoyoexpert.com/u/Yummy)
#### Post date: [August 4, 2016, 5:09pm UTC](https://forums.yoyoexpert.com/t/think-your-password-is-secure/81414/3 "2016-08-04T17:09:57Z")
TL;DR: If a website gets its password hashes dumped, all login credentials on that website are hosed.
Well yeah, we already knew that. Salting and hashing your password database less about making passwords impossible to retrieve and more about delaying the retrieval of the passwords. That way you can alert your users that their login credentials have been compromised and it’s time to replace that compromised password with a new one.
> [@](#):
>
> The list contained 16,449 passwords converted into hashes using the MD5 cryptographic hash function.
MD5 is a terrible choice for password hashing. MD5 by default is a very fast hashing algorithm and unsalted. Both of those characteristics make it very bad for password hashing, but great for things like checksums where speed is a good thing.
> [@](#):
>
> The CMU Software Engineering Institute considers MD5 essentially “cryptographically broken and unsuitable for further use”. [[1]](https://en.wikipedia.org/wiki/MD5)
If you use MD5 to hash passwords, you have thoroughly demonstrated that you should be fired.
> [@ckwiz911](#):
>
> Makes me want to use a PW manager.
PW managers are tricky business. They do take care of using a unique password on every service you use for you. That’s great! That protects you from one major piece of fallout from hash dumps. Attackers get a hash dump from one website, crack the hashes, and then use their newly found username/password pairs at other websites that have the same account. If you use the same username and password there, that account has now been compromised.
However, password managers also create a different single point of failure and have a large target on their back. Password managers are not perfect and have been compromised before. Here are a couple of examples:
> [@](#):
>
> The serious security holes were found and reported by the University of California Berkeley researchers named: Zhiwei Li, Warren He, Devdatta Akhawe and Dawn Song. The critical vulnerabilities were discovered in the popular password managers that includes RoboForm, LastPass, My1Login, PasswordBox and NeedMyPassword.
> **[Oops... Popular Password Managers Are Not As Secure As You Think](https://thehackernews.com/2014/07/oops-popular-password-managers-are-not.html)**
>
> Popular Password Managers including RoboForm, LastPass, My1Login, PasswordBox and NeedMyPassword are Not Secure As You Think.
> [@](#):
>
> On Monday password manager service LastPass admitted it had been the target of a hack that accessed its users’ email addresses, encrypted master passwords, and the reminder words and phrases that the service asks users to create for those master passwords.
> **[Hack Brief: Password Manager LastPass Got Breached Hard](https://www.wired.com/2015/06/hack-brief-password-manager-lastpass-got-breached-hard/)**
>
> On Monday password manager service LastPass admitted it had been the target of a hack.
---
### Author:  [@jhb8426](https://forums.yoyoexpert.com/u/jhb8426)
#### Post date: [August 4, 2016, 5:17pm UTC](https://forums.yoyoexpert.com/t/think-your-password-is-secure/81414/4 "2016-08-04T17:17:23Z")
I would probably never use a PW manager service. I’d rather take the time to use a local password vault app. on my system.
---
### Author:  [@Adhuck](https://forums.yoyoexpert.com/u/Adhuck)
#### Post date: [August 4, 2016, 8:56pm UTC](https://forums.yoyoexpert.com/t/think-your-password-is-secure/81414/5 "2016-08-04T20:56:56Z")
This is probably more a concern for the passwords you save on websites that are badly outdated and than it is for cryptographically locked computers, or big major companies like Amazon who I assume pay millions to keep their database secure.
It’s very easy in that exercise for the md5 hash to be turned back into passwords because brute force algorithms can make tens of thousands of guesses within a few seconds. My assumption here is that they take the md5 program, and run sample words, or generated words through it until it finds a match?
---
### Author:  [@jhb8426](https://forums.yoyoexpert.com/u/jhb8426)
#### Post date: [August 4, 2016, 10:09pm UTC](https://forums.yoyoexpert.com/t/think-your-password-is-secure/81414/6 "2016-08-04T22:09:56Z")
> [@Adhuck](#):
>
> My assumption here is that they take the md5 program, and run sample words, or generated words through it until it finds a match?
Yep, that’s the routine. They use a dictionary of millions of words including known password patterns along with educated guesses to speed things up.