05-27-2013, 02:13 PM
I think I saw this somewhere, but I love the idea. Everyone submits a password list/generation info for 1M, 1G, 1T, 1P, or whatever. Then when a major password breach happens you test those passwords against those released hashes. Whoever cracks the most wins. My take on this is everyone submit hashes (MD5, SHA1, and SHA256) of their password lists. The submitters check their password list against the hashes and they submit how many hashes they cracked. The "winner" needs to submit their password list or a way to easily generate those passwords and an explanation. If they can't/won't the next highest cracked needs to and so on.
The problems:
Disclaimer: This helps me a lot because I want to come up with a list of passwords around a couple trillion. So that I can make a lossy hash table with them.
The problems:
- Someone could hack into a large website and crack a lot of hashes. Then submit their list (or hashes of their list). Wait a little and release the hacked website's hashes or favorable subset. Then obviously win.
- Multiple large sites get hacked but the contest runners consult with a team to determine which one is the most favorable to them.
- No large website get hacked or hashes are not released.
Disclaimer: This helps me a lot because I want to come up with a list of passwords around a couple trillion. So that I can make a lossy hash table with them.