3 ms·
What is wrong with this password, for example? >RoliedigHembryonauCarmeliaid6 Seems pretty consistent with XKCD's comic on passwords.
by TurkishPoptart 7y ago
What is wrong with this password, for example?
>RoliedigHembryonauCarmeliaid6
Seems pretty consistent with XKCD's comic on passwords.
- pwinnski 7y agoIf you're using something like "CorrectHorseBatteryStaple6" and consider it a secure password, I have some bad news for you.
- half-kh-hacker 7y agoI dunno, I just did some back-of-the-envelope calculations and it seems to be okay: With 8 high-end GPUs, we see a Blowfish speed of about 100 kilohashes per second. [0] We assume we're cracking bcrypt strength 10, so we divide this number by 64 (2^10 ÷ hashcat's 2^4), and get about 1500 bcrypt checks-per-second. There are about 170,000 words in the OED, and we choose 4 at random to give us 170_000^4 = 8.3521 * 10^20. We can divide by 1500, but that still seems like a lot of seconds. (like, 3.5 ages of the sun) [0]: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...
- 0xdeadbeefbabe 7y agoUnless the hash is in a cookie or something I probably couldn't guess it either within the lifetime of the sun etc.
- ljcn 7y agoIt's got 80-120 ish bits of entropy, why is it not secure? (Assuming you're not referring to it literally being a well known password from a web comic.)
- Jwarder 7y agoNot the parent poster, but prior objections I've seen are that people don't do a good job at picking random words and four words is too few.
- missingrib 7y agoI assumed they meant using a diceware-like system to choose instead of literally making up words
- Diederich 7y ago> I have some bad news for you Can you expand on that?