4 ms·

In these kinds of conversations, I always find this xkcd to be very relevant: https://xkcd.com/936 https://xkcd.com/936

h4waii 10y ago
This comic is just that, a comic. It doesn't take in to account any modern computational considerations. Ignoring the fact that people are still picking these words from their limited vocabulary and likely basing it on their own experiences... Almost any computer can guess astronomically more than 1k/s. A simple multi-GPU system can easily break a 1B/s. Hash algos have a cost and they're different; from MD5 to SHA1 to bcrypt. Hash rates vary wildly.
- chias 10y ago
  And then, of course, there are the people who take it a little too literally and actually use "correcthorsebatterystaple" as their password ;) http://qz.com/501073/the-top-100-passwords-on-ashley-madison/ http://qz.com/501073/the-top-100-passwords-on-ashley-madison...
- yellowapple 10y ago
  > Ignoring the fact that people are still picking these words from their limited vocabulary and likely basing it on their own experiences... If people are doing so, then they've missed the point of the comic (which is basically just demonstrating the merits of a "diceware" password generation scheme). One should be generating these passwords actually-randomly (e.g. by rolling dice and picking words corresponding to the dice roll, or (less ideal but more practical) by using a program which picks the four random words for you). The whole point is to make a password that a human can remember without relying on the human to actually come up with said password on one's own. > Almost any computer can guess astronomically more than 1k/s. Sure, if they have direct access to the hashes (assuming the passwords are even being hashed...). The comic's threat model instead assumes that the brute force attempts are through "ordinary" means (like using an actual login screen), at which point 1k/s is pretty high even without factoring in things like account lockouts. This is actually made pretty clear in the comic itself (at least so I thought). Even with direct access to the hashes, though, the resulting passwords are sufficiently-long that they'd still take a rather long time to brute-force even with high-end computers (at least compared to the sorts of 6-to-14-character passwords most people use). This rather long time is made even longer if the attacker doesn't actually know that the victim is using a CHBS-style password. That's the key thing here: they're long without being difficult to memorize, and length is generally accepted to be the most important consideration (aside from ensuring the password is unique across applications and not in a dictionary of commonly-used passwords) when resisting a brute-force attack.

This comic is just that, a comic. It doesn't take in to account any modern computational considerations. Ignoring the fact that people are still picking these words from their limited vocabulary and likely basing it on their own experiences... Almost any computer can guess astronomically more than 1k/s. A simple multi-GPU system can easily break a 1B/s. Hash algos have a cost and they're different; from MD5 to SHA1 to bcrypt. Hash rates vary wildly.

chias 10y ago
And then, of course, there are the people who take it a little too literally and actually use "correcthorsebatterystaple" as their password ;) http://qz.com/501073/the-top-100-passwords-on-ashley-madison/ http://qz.com/501073/the-top-100-passwords-on-ashley-madison...
yellowapple 10y ago
> Ignoring the fact that people are still picking these words from their limited vocabulary and likely basing it on their own experiences... If people are doing so, then they've missed the point of the comic (which is basically just demonstrating the merits of a "diceware" password generation scheme). One should be generating these passwords actually-randomly (e.g. by rolling dice and picking words corresponding to the dice roll, or (less ideal but more practical) by using a program which picks the four random words for you). The whole point is to make a password that a human can remember without relying on the human to actually come up with said password on one's own. > Almost any computer can guess astronomically more than 1k/s. Sure, if they have direct access to the hashes (assuming the passwords are even being hashed...). The comic's threat model instead assumes that the brute force attempts are through "ordinary" means (like using an actual login screen), at which point 1k/s is pretty high even without factoring in things like account lockouts. This is actually made pretty clear in the comic itself (at least so I thought). Even with direct access to the hashes, though, the resulting passwords are sufficiently-long that they'd still take a rather long time to brute-force even with high-end computers (at least compared to the sorts of 6-to-14-character passwords most people use). This rather long time is made even longer if the attacker doesn't actually know that the victim is using a CHBS-style password. That's the key thing here: they're long without being difficult to memorize, and length is generally accepted to be the most important consideration (aside from ensuring the password is unique across applications and not in a dictionary of commonly-used passwords) when resisting a brute-force attack.