Tag: imgur

Imgur 官方發佈公告說明他們發現資料洩漏了：「Notice of Data Breach」，資料的洩漏是發生在 2014 年，包括了帳號與密碼：

Early morning on November 24th, we confirmed that approximately 1.7 million Imgur user accounts were compromised in 2014. The compromised account information included only email addresses and passwords. Imgur has never asked for real names, addresses, phone numbers, or other personally-identifying information (“PII”), so the information that was compromised did NOT include such PII.

然後 2014 年用的是 SHA-256：

We have always encrypted your password in our database, but it may have been cracked with brute force due to an older hashing algorithm (SHA-256) that was used at the time. We updated our algorithm to the new bcrypt algorithm last year.

以單台八張 GTX 1080 跑 hashcat 的速度來看 (出自「8x Nvidia GTX 1080 Hashcat Benchmarks」)，是 23GH/z 左右：

Hashtype: SHA256

Speed.Dev.#1.: 2865.2 MH/s (96.18ms)
Speed.Dev.#2.: 2839.8 MH/s (96.65ms)
Speed.Dev.#3.: 2879.5 MH/s (97.14ms)
Speed.Dev.#4.: 2870.6 MH/s (96.32ms)
Speed.Dev.#5.: 2894.2 MH/s (96.64ms)
Speed.Dev.#6.: 2857.7 MH/s (96.78ms)
Speed.Dev.#7.: 2899.3 MH/s (96.46ms)
Speed.Dev.#8.: 2905.7 MH/s (96.26ms)
Speed.Dev.#*.: 23012.1 MH/s

這對於鍵盤可以打出的所有字元來計算 (95 chars)，八個字的密碼只要 3.33 天就可以跑完；如果只考慮英文數字 (62 chars)，九個字的密碼只要 6.81 天。

這些還不是最新的 GPU，而且是單機計算，對於現在的攻擊應該會用 ASIC，可以考慮多三到四個數量級的數度在算 (看財力才會知道買多少機器)。

不過 Imgur 的帳號主要是參與討論 (因為不用帳號密碼也可以上傳圖片)，一般比較不會在上面註冊... 真的有註冊的因為沒有其他個資，主要是怕共用密碼的問題。如果有用 password manager 應該也還好。