That is one way an attacker can gain access to the browser's memory. It's not the only way.

Besides, administrative access does not necessarily mean that the attacker has complex attack code for every possible scenario included with whatever they're running. The more work they have to do to access your data, the less likely it is that they're doing that specific work.

Leaving stuff lying around in the open because an attacker potentially could have a specific countermeasure to more strict safety measures is equivalent to giving up. At that point you can just forego security at all because whatever you have might potentially have an exploit.

In my comment, '"cracking" referred to finding a password that matches the hash. That's common nomenclature. The found password doesn't have to be the original password but it's rather likely at the string lengths involved, especially since Kaspersky used a dictionary to back the attack.

Also, you wouldn't use a hashing function where a large number of inputs of a usual password length turn into the same hash. That would just make all passwords weaker. The point of hashing a password is to store something that (ideally) uniquely matches the correct password but can't be used to easily derive the password.

The factor of 1000 I gave was a very rough ballpark number. I couldn't find any good comparison between the actual throughput of MD5 and bcrypt or Argon2. And yes, a single round of SHA256 would be cracked quickly; it's much less work-intensive than Argon2 and even has dedicated hardware acceleration in modern CPUs. Argon2 with a high work factor is vastly more resistant than MD5 and SHA256.

Also, salting doesn't protect against brute force and enhanced dictionary attacks. The salt is stored with the password so the attacker knows it. It only protects against rainbow tables. Pepper protects against offline cracking.

As does Arch AFAIK. It's still very niche, though.

The difference in speed between MD5 and something like bcrypt or Argon2 is massive. We're talking orders of magnitude. That adds a layer of security – if hashing takes e.g. 1000 times longer than with md5, the 20 minutes to crack the least secure passwords suddenly turns into 14 days. Still not astronomical but a lot slower. The more secure algorithms also require more memory to run, leading to less effective parallelization.

Besides, MD5 is prone to collisions, which reduce the number of attacks needed. The attacker doesn't need the real password, just one that hashes to the correct value.

While they did do a more sophisticated dictionary attack, they also talk about rainbow tables, which only work if the hashes are unsalted. A more modern approach with salted passwords is immune to rainbow table attacks. An actually modern approach with salted and peppered Argon2 hashes makes the kind of offline attack Kaspersky did unfeasible in the first place.

For some reason Kaspersky never bothered to point this out. I'd expect a reputable cybersecurity company like them to at least include one line that urges developers to make use of a modern approach and gives pointers as to what that might be. But I suppose "we recommend passwords to be salted, peppered, and hashed with Argon2i or Argon2id with a sufficiently high work factor" wouldn't fit their narrative.

(I also just noticed that the advice part of Kaspersky's article is littered with references to the password manager they sell. Yep, it's an underhanded ad that just happens to contain some good security advice.)

You see, that's just inaccurate. GNU/Linux is not equivalent to GNU+Linux. That would be addition; this is division. The bigger Linux gets, the smaller GNU/Linux becomes.

That's why they've developed GNU/Hurd. Hurd is unlikely to ever amount to much, meaning that GNU/Hurd will never evaluate to a small value. And that is cold, hard mathematical fact.

I'd use at least one more: The one that unlocks your device shouldn't be the one that unlocks your password manager. Other than that, yes. Use a password manager, let it generate per-service passwords for you, and make sure you have a backup plan.

For example, I use a KeePass database shared across my devices via a self-hosted NextCloud. Each of my devices plus the server effectively holds a backup copy so I'd have to lose all of my devices plus the server before my password database becomes inaccessible. Since the server lives in a datacenter it also serves as a remote backup.

If your password manager is SaaS, you might want to investigate how to protect yourself from scenarios like the service being down or you losing access to the account.

I think Gunner means a biometrically unlocked second factor like a Yubikey or a smartphone's user attestation. Given how badly written the entire article is, I wouldn't be confused if that's what he originally said before they condensed his statement beyond comprehension.

So Kaspersky found out that MD5 passwords are unsafe. That's literally 20 year old news. Actually, Kaspersky found out that brute-forcing MD5 on consumer-grade hardware has become slightly faster than two years ago, which makes me wonder if Captain Obvious's secret identity is that of a Kaspersky cybersecurity expert.

El Reg concludes from this that we should ditch passwords, which they back up with the opinion of a second expert. This expert immediately tells them they're wrong, that passwords are perfectly fine if used with MFA, and that a lack of public knowledge about basic cybersecurity is the real issue. They somehow treat this as him agreeing with them.

Actual technological alternatives to traditional password use (such as passkeys or password managers with per-site passwords) are mentioned only as an aside or not at all. It never occurred to El Reg or Kaspersky to mention that MD5 has been considered obsolete since the days of Internet Explorer 7 and that more secure hashes like bcrypt have been around since the late 90s. For that matter, the Kaspersky source talks about rainbow tables without using the word "salt" even once.

Finally they conclude with a call to action to "improve that user security stack", arguing that passwords are inherently unsafe due to their "complex requirements and hashed storage". That's so deep into la-la land that I'm not even sure what it is they're trying to say or who they're even talking to.

That's an amazingly badly written article.

What impresses me the most is that the Kaspersky article they're talking about is just as asinine as El Reg's confused stammering. The most sense I can make out of it is that they're making a bad faith argument ("we can brute-force MD5'd passwords with a 5090 so you should use MFA") because they're trying to get nontechnical people to do the right thing and hope they can scare them into compliance if they bullshit hard enough.

Edit: I just noticed how often Kaspersky's article refers to the own password manager they sell. So their bad faith argument is really just in service of an ad that happens to contain some decent security advice.

Wang. He was an actor from the 20th/21st century who looked just like you, Harry. Say, what's that outside the Flyer? It appears to be some kind of...

The staff ate it later.

Rektor: "Gemäß Vorgabe des Landeskultusministeriums werden jetzt ein Lobgesang und die Bayernhymne gespielt. Ihr dürft mitsingen, wenn ihr wollt, aber wenn ihr das tut, weist das Kultusministerium darauf hin, dass jede Abweichung vom euch ausgehändigten Liedtext eine Straftat gemäß §90a StGB ist. Schweigen ist natürlich legal."

CSU. "Warum singen die Schüler nicht mit? Wir haben ausdrücklich darum gebeten."

This makes it easier. The less sophisticated an attack is needed (reading from memory whenever you want vs. extracting the key during decryption), the more of an attack surface there is.

That's especially a problem since Edge is based on Chromium, which has more careful handling of passwords by default. Microsoft had to actively change that to get the current behavior.