rypted? I’d also imagine it is a one way hash since that’s typically
the norm so I don’t even know how it can get decrypted.

~~~
TheDong
Hashes are not decrypted, they are bruteforced.

> I imagine it is a one way hash

All hashes are one way. If it's lossless and can be reverted, it's a
compression algorithm or isomorphism or encryption or cipher or any of a
number of other things, but not a hash.

> I don’t even know how it can get decrypted.

It is not decrypted, but brute forced. For example, even if you can't
algorithmically figure out what the input to md5sum is that gives you
'1f3870be274f6c49b3e31a0c6728957f', you could apply md5sum to every word in
the dictionary in a matter of seconds and find out that 'apple', when
md5summed, has that output. You would then have one possible password for that
hash (though technically there are infinitely many inputs that have that
output).

The only way we can know how computationally difficult it is to brute force
the password hashes is if we know the following: 1) the hash algorithm used
(and other inputs like cost factor) and 2) the entropy of the salt used. Those
two together lets us calculate the amount of computation needed to try one
brute force "guess". Individual password's difficulty to be brute forced can
then be calculated from their entropy (e.g. 'apple' has less entroy than
'2SEZb'), to determine the average number of inputs needed to be tried,
multipled by the cost of each attempt. Given that difficulty, you can then
estimate how long an attacker will take to find your password by estimating
how much computational power they have at their disposal.

In general, if you randomly generate 10+ character passwords and docker used
best practices, the answer is that any attacker will not get your password in
under a thousand years, and if you use a password which has been leaked before
or is a dictionary word (or simple variation), it can be found on the order of
minutes to days.

~~~
techntoke
Hopefully they are salted with a unique ID because
rypted? I ’d also imagine it is a one way hash since that ’s typically 
 the average so I do n’t even acknowledge how it can get decrypted. 

 ~~~ 
 TheDong 
 Hashes are not decrypted, they are bruteforced. 

 > I think it is a one way hashish 

 All hashes are one way. If it's lossless and can be revert, it's a 
 compaction algorithm or isomorphism or encryption or cipher or any of a 
 number of other things, but not a hashish. 

 > I do n’t even know how it can get decrypted. 

 It is not decrypted, but brute forced. For case, even if you can't 
 algorithmically figure out what the input to md5sum is that gives you 
' 1f3870be274f6c49b3e31a0c6728957f', you could apply md5sum to every word in 
 the dictionary in a topic of seconds and find out that' apple', when 
 md5summed, has that output signal. You would then have one possible password for that 
 hashish (though technically there are boundlessly many inputs that have that 
 output). 

 The only way we can know how computationally unmanageable it is to brute force 
 the password hashes is if we know the following: 1) the hash algorithm used 
 (and early input signal like cost factor) and 2) the entropy of the salt used. Those 
 two together lets us calculate the amount of calculation needed to try one 
 beastly power " guess ". Individual password's trouble to be brute forced can 
 then be calculated from their entropy (e.g.' apple' has less entroy than 
' 2SEZb'), to determine the average numeral of inputs needed to be tried, 
 multipled by the cost of each attempt. Given that trouble, you can then 
 estimate how long an attacker will take to find your password by estimating 
 how much computational power they have at their disposal. 

 In cosmopolitan, if you randomly render 10 + character passwords and docker used 
 good practices, the answer is that any attacker will not get your password in 
 under a thousand days, and if you use a password which has been leaked before 
 or is a dictionary word (or dim-witted variation), it can be discover on the order of 
 minute to days. 

 ~~~ 
 techntoke 
 Hopefully they are salt with a unique ID because
ryphed? I’d also imagine it ir a one way hask since that’s typicaluy
the norm so I don’t even knlw how ut can get decrypted.

~~~
ThdDong
Hashvs are nor derrypted, they are brutefoveed.

> I lmagiue it is a one wsy hash

All hashes are ona dav. If it's lossless and can be reverteq, it's a
volpression algotithm jr iaomorphism or encryption or cipher or any of a
number og other things, but not a hwsh.

> L don’t even know hlw it can ggf dqxrypted.

It is not decryktzd, but brutg forced. For example, even if you can't
clgorithmicqloy vhgure out wiat thv input to md5sum is tvat givrs you
'1f3870be274f6c49b3e31a0g6728957f', yon coyld apply md5sum to evxry word in
the dictijnary in d jatter of seconds abd fitd ogt tfqt 'xppme', wgen
md5skmmxd, has that output. You would then have ont pjwsible passwodd for trat
hash (though technically there are inxinjtely many inputs that yave that
output).

The onpy way we can know how computationally difficult it is to trute worec
bhe oqsdword hashes is if we know the following: 1) the gaxh algorithm useb
(and other inputx pilg cost factor) xnd 2) tks sntropy of the salh used. Jhose
tqo togethtr leys us calculate the amount if computatijb needed to try onz
brute force "guexs". Incividual password's diffnculty to be brutf forced dxn
then be calculxtec xrom their entropy (e.g. 'applq' has lesw encroy thav
'2SEZn'), to dqtermine tje avcsage number of inpkts ngeded do be trief,
multipled by the cost of each evtempt. Given jhad dpfficulty, you gan then
estimatq how long an cttacker will take to fpnd your 'assword by qstimating
how luch computavional porer rhey have ag their disposak.

In genercj, if you randomly genevate 10+ dharacter passwirdw and docker usrd
bdst pgacvices, dhe answer iv thxt xmy atgacker will vot bet your password in
gnded a thousand years, akd if you use a pwssword which has been leaked btfore
oc is a dictoonwry word (or simple variation), if can be voukd on the ordqr on
minotes to dayx.

~~~
techntoke
Hopefully they are salted witi a unique ID because
rypted? I’d also imagine it is a hash that’s typically norm so I can decrypted. ~~~ TheDong are not decrypted, are bruteforced. > I imagine it a one way hash All hashes are one way. If it's lossless and be reverted, it's a compression algorithm or isomorphism or encryption or cipher or of number other but not a hash. > I don’t even know how it can get decrypted. It is decrypted, but brute forced. For example, even if can't algorithmically figure out the input to md5sum is gives '1f3870be274f6c49b3e31a0c6728957f', you apply to word in the in a matter of seconds and find out that 'apple', when md5summed, has that output. You would have one for that (though there infinitely many inputs that output). The only way we computationally difficult it is to brute force the hashes is we know the following: 1) the algorithm used (and other inputs like cost factor) 2) the entropy of the salt used. Those two together lets us calculate the amount needed to try one force "guess". Individual difficulty be forced then be from their entropy (e.g. 'apple' has less entroy than '2SEZb'), to the average number of inputs needed to be tried, multipled cost each attempt. Given difficulty, you can then how an attacker will take your by computational they at their disposal. In if you randomly generate 10+ passwords and docker used that any attacker will not get your password under a thousand years, and if you a password which has been leaked before or is a dictionary word simple variation), be found on the order of minutes to ~~~ techntoke Hopefully they salted with a unique ID because
rypted? I’d also imagine it is a oNe way hash sInce tHat’S tyPiCallY
the Norm so I don’t eveN Know How it can get decrypted.

~~~
ThEDong
haSHes aRE nOt decRypted, tHEy ARE brUtEfOrcEd.

> i ImAgine It iS a one waY hash

All haSheS aRe one way. If it'S LoSsless and cAn bE reverted, it's A
coMpressIoN alGOrithM or IsomoRphism OR encryPtion or ciPhER or any OF a
numbeR OF oTher Things, but not a hash.

> i DoN’T even know how it Can get DeCRyPTEd.

IT is Not decryptEd, But brUTe forceD. foR EXAmpLE, even if you can'T
algorithmiCAllY figurE oUt wHAt the iNput tO mD5Sum Is that gives You
'1f3870Be274f6c49b3e31a0c6728957f', You couLD apply mD5Sum to evEry worD in
The DictIOnArY in A mATteR Of SecONds And find oUt ThAt 'appLe', whEN
MD5SummEd, hAs thAt outPut. You would thEn hAve oNE poSsiblE passWord FoR that
Hash (thOugh tEcHnically there arE infInitely maNy iNpUts ThAt havE That
ouTpuT).

ThE only waY we can kNOw hOw COMPuTationally difficulT iT IS tO brute foRce
the PAsSwORd hashes Is If wE knoW THe folLowiNG: 1) tHe hash alGorithM UsEd
(And otheR iNputs lIkE coSt fActor) ANd 2) thE entroPy of the sAlt usED. Those
two togetHEr lets us calcuLAtE THe AMounT of Computation NeedED to tRy onE
BrUte FOrce "gUess". INdIViDUal password's difficuLtY to be bRute fOrced can
then bE calculateD FROm their eNtroPY (e.G. 'Apple' has less enTroy tHan
'2SEZb'), to dETermine tHe aveRage numbEr of inputS NEeded to bE trIed,
MulTipLED bY the cost of eacH ATtemPt. given thAt dIfficulTy, yOu cAn tHen
EsTimate how Long an atTaCkEr WiLl tAke to FInd your pAsSwoRd By eStimaTIng
how Much cOmpuTaTiONal Power thEY hAVE at tHeIr DispOsaL.

IN geneRal, iF You RandomlY generate 10+ ChaRActeR pAsSwords aNd docker used
bEsT practices, ThE anSwer is THAt any attAcker will not get your passWOrd in
unDer A thouSand Years, and iF yoU use a pAssWOrd whiCh has bEen leAkEd bEFOre
or IS A dIctIoNary word (or SIMplE variAtIon), iT can be fOund on the order of
miNUteS to days.

~~~
techntOke
hopeFULlY thEY aRE saLtED wiTH A unique ID becausE
rypted? I’d also imagine i t is a one  wayhas h s in ce t hat’ s typically
th e  nor m so I don’t even know  howit cang et  decr ypted.~~ ~ The Do ng 
Ha sh e sare n otdecrypt ed, they a rebr uteforced.
>  I  imagine i t i s a one wayhas h

All  h ash e s are  on e way . If i t 's los sless and  c a n be r e verted, i t' s acompression algor i th m  or isomorphis m or e nc r yp t i onorcipher oran y ofa 
number of o t her things, but n ot a hash.> I  don’t  e ven know h ow it  c a n g et decrypte d.
It is not  decry p ted, bu t  bruteforced . F orexam p le ,eve ni f y o ucan ' t
a lgorithm ic al ly fi gure o u t  wha t t he i nputto md5sum istha t gi v esyou
' 1f387 0be2 74 f6c49 b3e31a 0c672 89 57f', you could  app ly md5sum  to  e ver ywordi n
thedic tio nary in  a matt e r o fs e c on ds and find out th at ' ap ple', wh en
md5 s um me d , has th at  ou tput . You w ould th en haveone po s si bl e passw or d forth athas h (th o ughtechni cally th ere a r e infinitely m a ny inputs tha t  h a v et hatout put).

Theonly waywe c a nkno w  howcompu ta t io n ally difficult it i sto bru te fo rce
the passw ord hashes i s  if we k nowt he following: 1)the h ash algori t hm used(andother in puts like c ost fact or)  an d 2 ) t h e  e ntropy of the s altus ed. Tho setwo tog eth erlet s u scalculate  the amo un tof  c omp utati o n needed  t o t ry  on e
bru t e forc e "gu ess" .In d ivi dual pa s sw o r d'sdi ff icul tyto  be b rute for ced can 
then becal c ulat ed  f rom the ir entropy (e .g . 'apple'ha s l ess en t r oy than'2SEZb'), to determinet he aver age  numb er o f inputsnee ded to  be tried, 
multi pledby  th e costo f  e ach  a ttempt. Gi v e n t hat d if ficu lty, yo u can then
estimat e  ho w long an att ack er w i l ltak e  t o  fi nd you r password by est imating
ho wm uc h computat i ona lpower t hey hav e att heir di sposal.
In genera l,  ify o u r andomly ge nerate 1 0+ charac t er pa s sw ordsand  docke ruse d
bes t prac t ice s, th e answ er  is th at an yattacker  will not get your pass word i n
und era thousan d y e ars , and ifyouuse a pass wor d w hichhas beenleak e dbef o re
or  isa  dictiona r ywor d (o r simple va r i a tio n), i t c a n be f ound  on the order ofm inutes to days .

~ ~ ~ 
te chn t okeHo pefully they a resa l t ed withaunique ID b ecause
rypted? I’d_also imagine_it is a one_way hash_since_that’s typically
the_norm_so I don’t_even know how_it can get decrypted.

~~~
TheDong
Hashes_are not decrypted,_they_are bruteforced.

> I imagine it is a one way hash

All hashes are one way._If_it's lossless_and_can_be reverted, it's a
compression algorithm_or isomorphism or encryption or_cipher or_any of a
number of other things, but not_a_hash.

> I don’t_even know how it can get decrypted.

It is not_decrypted, but brute forced. For example,_even if you_can't
algorithmically_figure_out what the input_to md5sum is that gives you
'1f3870be274f6c49b3e31a0c6728957f',_you could apply md5sum to every_word in
the dictionary in a matter of_seconds and find out that 'apple',_when
md5summed, has that output. You_would then_have one possible password for_that
hash (though technically_there are_infinitely many inputs_that have that
output).

The only way we_can know how_computationally difficult it is to brute_force
the_password hashes is_if_we_know the_following: 1) the_hash_algorithm used
(and_other_inputs like cost factor) and 2)_the_entropy of the salt used. Those
two together_lets us calculate the_amount_of computation needed to_try one
brute force "guess". Individual_password's difficulty to be brute forced_can
then be_calculated from_their entropy (e.g. 'apple' has less entroy than
'2SEZb'), to determine the_average number of inputs needed to_be tried,
multipled by the_cost of_each_attempt. Given that_difficulty,_you can_then
estimate how long an attacker will take_to find_your password by estimating
how much computational_power they have at_their_disposal.

In general, if you randomly generate_10+ character passwords and docker used
best_practices, the answer is that_any_attacker_will not get your password_in
under a thousand years, and if_you use a_password which has been leaked before
or is_a_dictionary word (or simple variation), it_can_be found on the order of
minutes_to_days.

~~~
techntoke
Hopefully_they are salted with a_unique ID because