3 ms·

If my calculations are correct, that GPU is making 1,000,000,000,000 guesses per second. The takeaway here is that cracking a 64bit password only cost $1700 an

If my calculations are correct, that GPU is making 1,000,000,000,000 guesses per second. The takeaway here is that cracking a 64bit password only cost $1700 and is totally doable in 3 weeks. If you need things to be really safe I guess you need to start lengthening those passwords.

kerng 7y ago
Not exactly, it requires a lot more computational effort since it's not just guessing a number (salt, iterations and hash function are there to make this much harder). However, the example shows that seemingly impossible things are indeed not that far away (even for ordinary people). Computers are amazing.
DuskStar 7y ago
> The takeaway here is that cracking a 64bit password only cost $1700 and is totally doable in 3 weeks. Not quite - you need to run the hash function that the password is stored with, and that might be a factor of 1,000,000+ slowdown relative to "are these numbers the same".
oxfordmale 7y ago
If you need things to be really safe, you should enable 2FA. Those $1700 of computational costs are likely to be run on hacked infrastructure, so definitely doable.
- michaelmrose 7y ago
  The 1700 estimate is probably off by a factor of a million. 1.7 billion in computation
gruez 7y ago
>If my calculations are correct, that GPU is making 1,000,000,000,000 guesses per second. >The takeaway here is that cracking a 64bit password only cost $1700 and is totally doable in 3 weeks. ...assuming that each "guess" only requires a comparison. If you factor in hashing, it's much slower. According to gpuhashcat benchmarks[1], a 1080 ti crack md5 passwords at ~25 GH/s (1GH/s = 1 billion guesses per second), phpass at ~6.9 MH/s, and bcrypt passwords at 13 KH/s. [1] https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...

3 ms·

If my calculations are correct, that GPU is making 1,000,000,000,000 guesses per second. The takeaway here is that cracking a 64bit password only cost $1700 an

by why-oh-why 7y ago

kerng 7y ago
Not exactly, it requires a lot more computational effort since it's not just guessing a number (salt, iterations and hash function are there to make this much harder). However, the example shows that seemingly impossible things are indeed not that far away (even for ordinary people). Computers are amazing.
DuskStar 7y ago
> The takeaway here is that cracking a 64bit password only cost $1700 and is totally doable in 3 weeks. Not quite - you need to run the hash function that the password is stored with, and that might be a factor of 1,000,000+ slowdown relative to "are these numbers the same".
oxfordmale 7y ago
If you need things to be really safe, you should enable 2FA. Those $1700 of computational costs are likely to be run on hacked infrastructure, so definitely doable.
- michaelmrose 7y ago
  The 1700 estimate is probably off by a factor of a million. 1.7 billion in computation
gruez 7y ago
>If my calculations are correct, that GPU is making 1,000,000,000,000 guesses per second. >The takeaway here is that cracking a 64bit password only cost $1700 and is totally doable in 3 weeks. ...assuming that each "guess" only requires a comparison. If you factor in hashing, it's much slower. According to gpuhashcat benchmarks[1], a 1080 ti crack md5 passwords at ~25 GH/s (1GH/s = 1 billion guesses per second), phpass at ~6.9 MH/s, and bcrypt passwords at 13 KH/s. [1] https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...