4 ms·
How can you say it doesn't scale? You just need to spin up a cluster that is powerful enough to get down to let's say a week. The cost of this would be a joke f
by iagooar 10y ago
How can you say it doesn't scale? You just need to spin up a cluster that is powerful enough to get down to let's say a week. The cost of this would be a joke for a company / institution of a certain size.
- cmdrfred 10y ago1 week only tests 1 password. It would have to run for years to get a decent set of results. I don't see how a company can afford all that hardware and power to do something that is illegal to begin with. How do they monetize it to get a return?
- iagooar 10y agoYou just need to target certain accounts, no need for all.
- iagooar 10y agoAnd don't forget, that every 18 months, the amount of processing power you get for a modest price, doubles.
- nikbackm 10y agoStill?
- marcosdumay 10y agoNot anymore. It's hard to get specific numbers about a trend that just changed. But the double every 18 months is now clearly wrong. We've got a couple of approximately 27 months doubling, but that is past too. My bet is that we won't get a fixed number ever again.
- tracker1 10y agoI'm not sure the fastest per core speed for the last 5 years in CPUs is significantly faster.. more cores, more caches for some operations, but not nearly the growth we used to see.
- cm2187 10y agoWell, I was surprised by these benchmarks: http://www.anandtech.com/show/10404/asrock-deskmini-110-ministx-pc-review/2 http://www.anandtech.com/show/10404/asrock-deskmini-110-mini... When you compare the skull canyon CPU and the i5 6500: http://ark.intel.com/compare/93341,88184 http://ark.intel.com/compare/93341,88184 The i5 has better specs on pretty much any aspect, but the skull canyon does way better in those benchmarks. I am told the impact is the 128MB eDRAM which acts as a L4 cache. So maybe that's the way for computers to become much faster, making everything around the CPU go faster. Integrate the RAM and the GPU on the chip. Superfast SSDs. Etc.
- cmdrfred 10y agoLet's say that were true, so in a year and half you will only have to spend 20 years cracking the passwords? Bcrypt is designed for this exact situation and performs pretty well.
- iagooar 10y agoI am not saying bcrypt is bad. But thruth is, we have to be constantly challenging our assumptions about security and avoid feeling like the battle is "won".
- kalleboo 10y ago> I don't see how a company can afford all that hardware and power to do something that is illegal to begin with. An evildoer would use stolen credentials, stolen credit cards, or stolen hardware (botnets).
- matthewmacleod 10y agoIt does technically scale, just like everything else :) But I think the parent's point was that this compute time only lets you check one password against one account. All you can do, after this compute time, is state that "'monkey' is/ is not the correct password for @iagooar's account". Those results can't be used to check other accounts (because they're salted) so this approach doesn't really scale well at all. It might, for a huge adversary (state-scale) allow a single password to be cracked in a reasonable timeframe, iff it's relatively simple password.