As far as I know, the passwords aren't stored in the databases, it's the hash produced by a one-way function that is stored in the database. Grabbing these is useless.
this post was submitted on 19 Jun 2025
-23 points (28.3% liked)
Technology
71949 readers
8808 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
Hashes can be brute forced, it's just normally too expensive to do so for any reasonably complex password. If you're using "password123" as your password even a hashed password is easily cracked (salting and peppering can help make this more difficult, although still not impossible).
I'm perfectly aware anything can be brute forced and that's why it doesn't worth to mention. Now, the amount of resources required to brute force a hashed password has nothing to do with the complexity of the password. No matter what the password is, the hash will have a fixed length and appear as a random sequence of bytes. Otherwise you are not doing it properly.
The complexity of the password has something to do with guessing the password from dictionary or known most common passwords.
Kind of both. The modern way of brute forcing is to just hash the 100,000 or so most common passwords, previously leaked passwords, and minor permutations of all of the above. It's computationally and space intensive, but for a determined attacker entirely doable on modern hardware. That's why complexity matters, because it's not a simple iteration through every possible permutation, but a targeted search through a known password list.
That's why it's not brute force anymore.
What is this article? Besides terrible, I mean. This article is terrible.
First of all, this isn't a new leak. It's not even a combination of old leaks. It's just somebody noticing that a bunch of leaks existed and did an Excel Sum operation on the passwords on them.
According to Vilius Petkauskas at Cybernews, whose researchers have been investigating the leakage since the start of the year, “30 exposed datasets containing from tens of millions to over 3.5 billion records each,” have been discovered. In total, Petkauskas has confirmed, the number of compromised records has now hit 16 billion. Let that sink in for a bit.
And to add insult to injury, the article has this gem:
Is This The GOAT When It Comes To Passwords Leaking?
Password compromise is no joke.
Certainly not with writing like this.
https://news.ycombinator.com/item?id=41590466 https://larslofgren.com/forbes-marketplace/
tldr OP shouldn't be posting Forbes articles
And spelling mistakes in an article from Forbes? Total garbage.
Clickbait from Forbes, with not a single mention of 2FA/Two Factor Auth?
https://files.catbox.moe/n4627i.jpg
Colour me not surprised.