The Inquirer-Home
Comments
Google is a password dictionary

I was initially quite alarmed by this article, until I realized that Google can't actually crack passwords. 

Google is handy for finding things that look like MD5 hashes, but there is no obvious link between those hashes and the open text used to produce them. 

After all, the researcher didn't find a page that linked Anthony to the MD5 hash; they found the MD5 has and inferred what the password was.

There are a few unanswered questions. First, why wasn't a common word like "Anthony" in the dictionary that the researcher originally used? 

Second, would the researcher have had any luck matching MD5 hashes if the password were something less common, like "Anthony1"?

I have learned two things from this story. First, even when you hack into a system you should use a secure, hard to guess password :-) 

Second, doing a Google search for a MD5 hash seems like a quick and easy way to tell if you picked a secure password. I expect that the MD5 hash of every common word will show up in a Google search; so if a search for a particular MD5 hash doesn't find anything, it's an indication of a good password. 

Maybe this is a business opportunity.

posted by : jimsum, 22 November 2007 Complain about this comment

Google can crack passwords

aboutus
Advertisement
Subscribe to INQ newsletters
Advertisement
INQ Poll

Authorities in several countries raided Megaupload recently, shut down all of its services, seized hundreds of servers and arrested several of its executives on criminal charges.

Do you think the move was justified?