3 ms·

If you almost know the right passphrase, it can be. If you don't, and the passphrase is good, it can't.

• _ph_ 10y ago
  Thats, that is reassuring :). Would have been a good addition to that article. Of course, if you are lacking just a few letters in the password, brute forcing gets much more applicable.
• mistercow 10y ago
  To be clear, it's if you know more or less the right passphrase. This is why your passphrase should be randomly generated. Word based passwords are still fine (for memorability, a la xkcd), but you need real entropy that can't be guessed. For example, if you choose your daughter's middle name your favorite animal, and the street you grew up on, then you have a small amount of entropy, and you'll be screwed in an offline attack scenario like this. The attacker can narrow it down to combinations of words and numbers related to you, and the brute force becomes feasible. If you use four randomly chosen words from a dictionary of 2000 words, then cracking it is roughly equivalent to cracking 13 random digits. Side note: cycling through multiple random pass-phrases of this type until you find something memorable has difficult-to-analyze negative effects on the final entropy. Ideally, you should be using the first output it gives you.
• bigiain 10y ago
  Yeah - this solves the "I know I used 'correct horse battery staple', but can't remember if it was correct-horse-battery-staple or correct_horse_battery_staple or c0rrect+h0rse+battery+staple or c0rr3cth0r53b4tt3ryst4pl3 or whatever... None of this would have helped if he wasn't sure exactly which error he'd made with a password like %)]5ZJ'HDb]n.'Y&4P-dMZMvS