In theory, MD5 and SHA1 hashes suffer from a weakness known as "collisions", where two different strings of text result in the same hash.  That means that if your password was "abcd1234" the hash stored in the database might be the same as the hash for "wxyz7890", so an attacker doesn't have to try every possible combination of characters that a 128 bit (for MD5) or a 160 bit (as used by WWF) hash would imply.  I could be so easy that an semi-skilled script-kiddie with an average gaming PC could find a collision in a matter of hours.  However, the technique used to exploit the weakness requires the attacker to possess the password hash, which WWF does not provide.

 

If an attacker gains access to your database, he has access to the hash and the salt and, presumably, your source code.  With all that information, and assuming the one-way hash of WWF is equally vulnerable to collisions, the attacker doesn't have to find your password, he just has to find a set of characters that produces the same hash.  If the attacker does not have access to the database, then he has to try billions upon billions of possible passwords, and through the WWF web interface is laughably impractical even if the hash function suffers from collision weaknesses.

 

If the hash used in WWF were MD5, this might be a concern since tools are being developed to demonstrate the MD5 weakness and so punks don't have to understand encryption, just how to use the tool.  Maybe there are people out there who know of a flaw or weakness in the WWF one-way hash, but it seems unlikely given the depth of knowledge it implies.

 

In short, your passwords (and only your passwords) are very secure against being decrypted.  Everything else in the equation is so vulnerable that WWF passwords can safely be an after-thought.

 

 

Tuesday October 11, 2005 3:11PM PDT

Isn't this the method used?