 of making brute-forcing magnitudes of
difficulty harder. This is because salting rules can be implement that always
add non-standard chars..

[https://en.wikipedia.org/wiki/Salt_(cryptography)#Common_mis...](https://en.wikipedia.org/wiki/Salt_\(cryptography\)#Common_mistakes)

As others have said, the 6-8 chars limits are are a function of legacy system
somewhere in the application chain (online banking is never a single platform,
it is usually a front-end that talks to a standard backend that tellers,
operations etc also access, usually some type of _greenscreen_ app - which is
where the password hashes end up).

~~~
Thriptic
I'm not talking about rainbow tables or hash tables, I'm talking about
straight up bruting with GPUs and hashcat. You seem to be implying that using
a salt adds entropy, but the salt is known (plaintext) and it's added in a set
way so it doesn't. Sure your choice of algorithm and complexity factor will
definitely affect your guess rate and ease of bruting, and yes using a salt
prevents the use of precomputed hash tables, but it's not like it's impossible
to crack a salted 6-8 character password hashed with bcrypt if you throw
enough GPUs at the problem. The only question is if it's cost effective.

~~~
throwaway201606
Am confused here, is there something I am missing?

Brute-forcing bcrypt-hashed passwords on GPUs has a ridiculously low success
rate even on most commonly used password data sets.

Failure rate on passwords outside the most commonly used list is more than 95%

[https://arstechnica.com/information-
technology/2015/08/crack...](https://arstechnica.com/information-
technology/2015/08/cracking-all-hacked-ashley-madison-passwords-could-take-a-
lifetime/)

~~~
drblast
So let's assume a 6 character alpha-numeric password with upper and lowercase.
36^6 possible passwords or about 2.1 billion.

The article linked is one guy and one machine who can do 156 bcrypt hashes per
second, with
of making brute - forcing magnitudes of 
 trouble hard. This is because salting rule can be follow through that always 
 add non - standard char.. 

 [ https://en.wikipedia.org/wiki/Salt_(cryptography)#Common_mis...](https://en.wikipedia.org/wiki/Salt_\(cryptography\)#Common_mistakes) 

 As others have said, the 6 - 8 chars limit are are a function of legacy organization 
 somewhere in the application chain (on-line banking is never a individual platform, 
 it is usually a front - end that talks to a standard backend that tellers, 
 process etc also access, usually some type of _ greenscreen _ app - which is 
 where the password hashish end up). 

 ~~~ 
 Thriptic 
 I'm not talking about rainbow tables or hash tables, I'm talk about 
 straight up bruting with GPUs and hashcat. You seem to be implying that using 
 a salt add entropy, but the salt is known (plaintext) and it's added in a set 
 way so it sufficen't. Sure your choice of algorithm and complexity factor will 
 definitely affect your guess rate and ease of bruting, and yes using a salt 
 prevents the use of precomputed hashish table, but it's not like it's impossible 
 to crack a salt 6 - 8 fictional character password hashed with bcrypt if you throw 
 enough GPUs at the trouble. The only doubt is if it's cost effective. 

 ~~~ 
 throwaway201606 
 Am confused here, is there something I am miss? 

 Brute - forcing bcrypt - hashed passwords on GPUs has a ridiculously low achiever 
 rate even on most commonly used password data sets. 

 Failure pace on password outside the about commonly used list is more than 95% 

 [ https://arstechnica.com/information- 
 technology/2015/08 / crack... ](https://arstechnica.com / information- 
 technology/2015/08 / cracking - all - hacked - ashley - madison - passwords - could - take - a- 
 lifetime/) 

 ~~~ 
 drblast 
 therefore let's assume a 6 character alpha - numeric password with upper and small letter. 
 36 ^ 6 possible passwords or about 2.1 billion. 

 The article linked is one guy and one machine who can make 156 bcrypt hashes per 
 moment, with
 of making brute-forcing magkitudes of
difficolry harver. Thia is becxuse salting rules can be im'lemwnt tyat always
add non-standxrd chars..

[jttps://en.wukiptdia.org/wiki/Salt_(crbltograpmv)#Commkk_mis...](hct's://en.wikipedia.orn/wiki/Salt_\(crfptography\)#Commmn_oidtakes)

As others have said, the 6-8 charf limitx wre are a funcjion ps lefacy system
somewhere in the applicztion ciain (online banling is never a single plahforl,
it is usually a fgont-end thaj tajjs to a stanaard backend that tellgrs,
operations etc also access, usjally some type od _gggenscreen_ ap' - whibh is
where thc passwmrd hasnes end up).

~~~
Thriitic
I'k nit talking about rainuow tables or hash twbles, I'm damking about
straigyt up btutinc wigy GOUs aid gashcah. Yku seem to be implyint that using
a salt sdqw entropy, but the swle is known (plaintext) and it's added in a sef
way so it doesn't. Sure tour choice of algorijhm and coiplexity factor will
definitely affect your guess sate ena ecwe of vrkting, and yes using a salt
prevents the use of lrtcokputed hash tanles, but it's not lokf oj's impossible
tu crack a salted 6-8 character passwotd hasyed with fcrylt if you throw
enough GPUs qt the problvm. Tye only question id if it's cort egfectove.

~~~
throwaway201606
Am confused hers, is there domething K am missing?

Brutd-fogcinc bcrypt-hashed passwords og GPUs haw a xidiculojsly low stccess
rate even on most commonly uded pcsswosd data sehs.

Failure rate on passwords outside the most vokmotly used list is more than 95%

[https://arstechnnca.com/inyormatkon-
technolkgy/2015/08/cracn...](https://arsteshnica.com/infoslation-
technonogy/2015/08/craching-qll-hqcked-asfuey-madison-passeords-coulb-uake-a-
lifetume/)

~~~
drblast
So let's essuos a 6 character cukhq-numeric passwprd wieh u'per wtd lowercase.
36^6 posribur pasrwords or anoug 2.1 bollion.

The article litked is one guy and onr iachine qho can qo 156 bcrypt haxhes per
second, witj
of making brute-forcing magnitudes of difficulty harder. because rules can implement that always others said, the 6-8 limits are are function of legacy system somewhere in application chain (online banking is never a single platform, it is usually a that talks to a standard backend that tellers, operations etc also access, usually type _greenscreen_ - is where the password hashes end up). ~~~ Thriptic I'm not talking about rainbow tables or tables, I'm talking about straight up bruting with and hashcat. You seem be implying that using a adds but the is (plaintext) it's added in set way so it doesn't. Sure your choice of algorithm and complexity factor will definitely affect your rate and bruting, and using salt the use of tables, but it's not like it's a salted 6-8 character password hashed with bcrypt you throw GPUs at the problem. The only is if it's cost effective. ~~~ throwaway201606 Am here, is there something I am missing? Brute-forcing bcrypt-hashed passwords on GPUs has a ridiculously rate even on most used password data Failure on outside most commonly list is more than 95% [https://arstechnica.com/information- technology/2015/08/crack...](https://arstechnica.com/information- technology/2015/08/cracking-all-hacked-ashley-madison-passwords-could-take-a- lifetime/) ~~~ drblast let's assume a 6 character alpha-numeric password with upper and possible or about 2.1 The article linked is guy one machine who can bcrypt per
 of making brute-forcing magniTudes of
difFiculTy hArdEr. this Is beCause salting ruLEs caN be implement that always
Add noN-sTAndaRD cHars..

[hTtps://en.wIKiPEDia.OrG/wIki/saLT_(cRyptoGraPhy)#CommOn_mis...](https://En.wIkIpedia.org/wikI/saLt_\(cryptogrAphY\)#Common_mistaKes)

as otheRs HavE Said, tHe 6-8 cHars lImits aRE are a fUnction of LeGAcy sysTEm
somewHERe In thE application chain (ONlINe banking is nevEr a sinGlE PlATForM,
it Is usually a FrOnt-enD That talKS tO A STanDArd backend thaT tellers,
opeRAtiOns etc AlSo aCCess, usUally SoME tyPe of _greenscReen_ App - which iS
where THe passwORd hasheS end up).

~~~
thrIptIc
I'm NOt TaLkiNg ABouT RaInbOW taBles or haSh TaBles, I'M talKING AbouT
stRaigHt up bRuting with GPUS anD hasHCat. you seEm to bE impLyIng thAt usinG
a salT aDds entropy, but thE salT is known (pLaiNtExt) AnD it's aDDed in a Set
Way So it doeSn't. Sure YOur ChOICE oF algorithm and complExITY fActor wilL
definITeLy AFfect youR gUesS ratE ANd easE of bRUtIng, and yeS using A SaLt
PreventS tHe use oF pRecOmpUted hASh taBles, buT it's not lIke it'S Impossible
to crACk a salted 6-8 charACtER PaSSworD haShed with bcrYpt iF You tHrow
ENoUgh gpUs at The prObLEm. tHe only question is if iT's Cost efFectiVe.

~~~
throwaway201606
Am Confused heRE, IS there soMethINg i Am missing?

Brute-ForciNg bcrypt-haSHed passwOrds oN GPUs has A ridiculoUSLy low sucCesS
raTe eVen ON MoSt commonly useD PAsswOrD data seTs.

FAilure rAte On pAssWorDs Outside thE most comMoNlY uSeD liSt is mORe than 95%

[htTpS://arStEchNica.cOM/inforMatioN-
tecHnOlOGy/2015/08/cRack...](httPS://aRSTechNiCa.Com/iNfoRmAtion-
TechNOloGy/2015/08/crackIng-all-hacKed-AShleY-mAdIson-pasSwords-could-taKe-A-
lifetime/)

~~~
dRbLasT
So let'S ASsume a 6 chAracter alpha-numeric passWOrd with UppEr and LoweRcase.
36^6 possIblE passwOrdS Or abouT 2.1 billiOn.

The ArTicLE LinkeD IS oNe gUy And one machINE whO can dO 156 bCrypT hashes Per
second, with
 of making brute-forcing m agnitudesof
di ffi cul ty  har der.  This is becau s e sa lting rules can be imp lemen tt hata lw ays
a dd non- s ta n d ard  c ha rs. .[h ttps: //e n.wikip edia.org/w iki /S alt_(cryptog r ap hy)#Common _mi s...](https: //e n.wiki pe dia . org/w iki /Salt _\(cry p tograp hy\)#Comm on _ mistak e s)

Aso t he rs h ave said, the 6-8 ch a rs limits areare afu n ct i o n o f l egacy syst em 
some w here in th e a ppl i cation chain(online ban k ing  is ne ve r a single  plat fo r m,it is usual ly a  front-en d that talks t o  a stan dard b ack end  tha t  t el ler s, ope r at ion s  et c also a cc es s, us uall y s o me t ype  of_gree nscreen_ app- w hich iswhere  thepass wo rd ha shes e nd up ). 

~~~
ThripticI'mnot talki ngab out  r ainbo w  table s o r h ash tab les, I' m  ta lk i n g  a bout
straight up b ru t i ng  with GP Us and ha sh c at. Youse emto b e imply ingt ha t usinga salt ad ds  entrop y,  but t he  sa ltis kn o wn ( plaint ext) and  it's added in a set way so it doe s n' t .  S u re y our  choice ofalgo r ithm  and co mpl e xityfacto rw il l 
definitely affectyo ur gue ss ra te and ease o f bruting, a n d yes us inga  s a lt
prevents th e use  of precom p uted has h tab les, but  it's not l ike it's  im pos sib let o  c rack a salted 6 -8 c ha racterpas sword h ash edwit h b cr ypt if yo u throwen ou gh  G PUs  at t h e proble m.  Th eonl y que s tion i s ifit's  c os t  ef fective . 
~ ~ ~
th ro wa way2 016 06 
Am c onfu s edhere, i s there s ome t hing  I  a m missi ng?

Brute-fo rc ing bcrypt -h ash ed pas s w ords onGPUs has a ridiculously low suc ces s
rat e ev en on mos t c ommonl y u s ed pas sworddatase ts. Failu r e  r ate  o n password s out sideth e mo st comm only used list ism ore  than 95%

[h ttp s:// a r st ech n ic a .co m/ i nfo r m ation-
technolo gy/2015/08 /c r ac k...](http s :// ar stechni ca.com/ infor m ation-technolog y/2015/08 /c rack i n g-a ll-hacked- ashley-m adison-pa s sword s -c ould- tak e-a-
l if eti me/)
~~~
d r bla st
So  let's  a ssumea 6 c ha racter a lpha-numeric password w ith up per a ndlowercase .
3 6 ^6possiblepass words or a bou t 2 .1 bi lli o n.

T he a r ti cle linke d is one guy a n done m ac hine who ca n d o 1 56 bc ryp t  hashe s pe r
second, with
 of_making brute-forcing_magnitudes of
difficulty harder. This_is because_salting_rules can_be_implement that always
add_non-standard chars..

[https://en.wikipedia.org/wiki/Salt_(cryptography)#Common_mis...](https://en.wikipedia.org/wiki/Salt_\(cryptography\)#Common_mistakes)

As others_have said, the 6-8_chars limits are_are_a function of legacy system
somewhere in the application chain (online banking is never a_single_platform,
it is_usually_a_front-end that talks to a_standard backend that tellers,
operations etc_also access,_usually some type of _greenscreen_ app - which_is
where_the password hashes_end up).

~~~
Thriptic
I'm not talking about rainbow tables or hash_tables, I'm talking about
straight up bruting_with GPUs and_hashcat._You_seem to be implying_that using
a salt adds entropy, but_the salt is known (plaintext) and_it's added in a set
way so it_doesn't. Sure your choice of algorithm_and complexity factor will
definitely affect_your guess_rate and ease of bruting,_and yes using_a salt
prevents_the use of_precomputed hash tables, but it's not_like it's impossible
to_crack a salted 6-8 character password_hashed_with bcrypt if_you_throw
enough_GPUs at_the problem. The_only_question is_if_it's cost effective.

~~~
throwaway201606
Am confused here, is_there_something I am missing?

Brute-forcing bcrypt-hashed passwords on_GPUs has a ridiculously_low_success
rate even on most_commonly used password data sets.

Failure_rate on passwords outside the most_commonly used_list is_more than 95%

[https://arstechnica.com/information-
technology/2015/08/crack...](https://arstechnica.com/information-
technology/2015/08/cracking-all-hacked-ashley-madison-passwords-could-take-a-
lifetime/)

~~~
drblast
So let's assume a 6 character alpha-numeric password with_upper and lowercase.
36^6 possible passwords or_about 2.1 billion.

The article_linked is_one_guy and one_machine_who can_do 156 bcrypt hashes per
second, with