4 ms·
Link: https://password.kaspersky.com/ https://password.kaspersky.com/ I'm impressed by the password cracking estimation with the Tianhe-2 Supercomputer. A 10-
by pdq 10y ago
Link: https://password.kaspersky.com/ https://password.kaspersky.com/
I'm impressed by the password cracking estimation with the Tianhe-2 Supercomputer. A 10-character password containing uppercase letters, lowercase letters, and numbers, which is estimated at a 4 year crack with a Macbook Pro, takes 31 seconds on the supercomputer.
- zaroth 10y agoThe timing are meaningless since it depends entirely on the hashing algorithm and how much key stretching was in place. Is even the basic ratio/multiplier correct? Supercomputer is 1,000,000x faster than a 2012 MacBook Pro? I tried a few random strings and saw ratios as high as 3,000,000 - why would the ratio change based on the password? Probably because the number is nonsense.
- 1024core 10y ago> why would the ratio change based on the password? Probably because they may assume a dictionary order of cracking attempts?
- zaroth 10y agoI mean, why would the supercomputer sometimes be 1,000,000 times faster and then for a different password be 3,000,000 times faster?
- ufo 10y agoThe ratio is always 3000000 (I checked the Javascript Source). The discrepancy you see might have to do with the rounding that happens when they convert the time to a human-readable representation.
- ufo 10y agoLooks like they are using zxcvbn[1] to calculate the password entropy and converting it to a time with these parameters: computers speed factor ------------------------------------------------ ZX Spectrum k: 1300 // 30 guesses per hour (?) Mac Book Pro (2012) k: 1 // 10 guesses per second (?) Conficker botnet k: 5e-5 // 20000 guesses per second (?) Tianhe-2 Supercomputer, k: 3e-7 // 3000000 guesses per second (?) The following line of code suggests that the speed factor is compared to 10 password guesses per second: Passwrdr.crack_time = result['crack_times_seconds']['online_no_throttling_10_per_second']; [1] https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn
- ryanlol 10y agoDamn, my desktop is a total of 80000000000/3000000=26666.6666667 times faster than the Tianhe-2 supercomputer! More realistically though, Kaspersky just really sucks at password cracking.
- forgotpwtomain 10y ago62^10 > 2^58. At 2^58 that would take ~ 2.28E+09 guesses per second - I'm really not buying this.
- ryanlol 10y ago2.28E+09 is only a tiny fraction of what modern desktop computers can do against weaker hashes/ Mine easily hits 80Ghash/s on MD5 and around 25Ghash/s on SHA1, a more dedicated setup could easily do 10x that.
- forgotpwtomain 10y agoPasswords hashed with a single iteration; not to mention SHA1 - seriously? (bcrypt should be around 100ms)
- ryanlol 10y agoI'll worry about bcrypt when people start using it.