Next time password cracking comes up conversationally and someone says "And can't you can just use rainbow tables" ... send them this.
https://hashcat.net/faq/rainbowtables
tl;dr They are only worthwhile in a very specific (and rare) set of circumstances.
@epixoip@infosec.exchangeTeam #Hashcat is pleased to present our much anticipated write-up for this year's #CrackMeIfYouCan contest at #Defcon32
:boosts_welcome:
I bought these cool little NXP - NTAG213 "business cards" from the clearance section at Walmart. They're branded as "popl PhoneCard". They have a hard coded hyperlink to popl.com with some tracking data to link it to an account that you have to access with a sketchy app. They're password locked so I can't rewrite them. I looked it up [www.reddit.com] & found "74657329" in hex or "tes)" in ASCII to be the password, but neither of these work for these cards & the posts I found are all old. I don't have the equipment to sniff a password from the app, if it even does that which I doubt. Is there a way to crack NFC card passwords from an Android phone?
#NFC #PasswordCracking #ntag213
Attack wrangles thousands of web users into a password-cracking botnet - Enlarge (credit: Getty Images)
Attackers have transformed hund... - https://arstechnica.com/?p=2008817 #passwordcracking #passwords #security #websites #botnets #biz&it
Or other password "systems" use prepending and appending of constant strings, while varying the inner part depending on the site/service. Again, these are not hypothetical - these are obfuscated cracks of real passwords.
Keeping the right-hand side constant is less common, but also a thing.
@epixoip@infosec.exchange#TeamHashcat is pleased to present our write-up for this year's @CrackMeIfYouCan contest at #Defcon31
Again, I implore people who don't regularly crack passwords to talk to people who do before publishing things.
Specops lists rainbow tables as still a thing, with no caveats. Rainbow tables are such a minor niche now, with such limited usefulness, that it's irresponsible to not say so in writeups. And no one uses Ophcrack anymore.
And stating that weakly-hashed passwords mean that "a system that stores user password hashes with one of these algorithms could have its entire database cracked quickly" is flat-out false.
https://www.bleepingcomputer.com/news/security/top-5-password-cracking-techniques-used-by-hackers/
Read it here: