4 ms·
There's no KDF in the world that can protect you if your password is in a top-10,000 list or exposed elsewhere alongside your username.
by stouset 5y ago
There's no KDF in the world that can protect you if your password is in a top-10,000 list or exposed elsewhere alongside your username.
- tyingq 5y agoRight, but that's sort of what I was getting at. The article doesn't talk much about the password other than it's "insecure". It's probably worth mentioning that a dictionary attack at some multiple of ~2/per-second/per-core is possible. So it's not just top-10,000 list, but maybe "top million" or more that's a bad idea.
- woodruffw 5y agoYes, I think that's what the GP was trying to say. The post doesn't qualify "insecure" meaning "not best practices" vs. "insecure" meaning "your password is an extremely common one."