4 ms·
> I downloaded the popular rockyou.txt wordlist and put my actual vault master plaintext password inside (using a quarter of the wordlist), otherwise it would t
by lvncelot 4y ago
> I downloaded the popular rockyou.txt wordlist and put my actual vault master plaintext password inside (using a quarter of the wordlist), otherwise it would take 6 hours+ to crack.
I don't believe the 6 hours+ claim. (Or rather, the "+" is doing some serious lifting in that sentence.)
Looking at the password, it's of the correct-horse-battery-staple variety, which could be conservatively estimated at 44 bits of entropy (this is even ignoring the additional number appended to a random word) - which would take even the described "multi-gpu" setup with 2 million hashes a second just about 100 days to exhaust (or 50 days to have a 50% chance of getting it), let alone the 1000 hashes a second macbook the author was using.
- gvb 4y agoYour quote includes the most significant part of the article "and put my actual vault master plaintext password inside". He took a word list which did not include his password and put his actual password in the word list. He didn't crack his password, he showed that a brute force password guesser can find passwords that are in its word list. If he wanted to save six hours, he could have put it first in the password list. No news here.
- birdyrooster 4y agoGood article is good, it shows brute force works with brute force.
- lvncelot 4y agoYes, which is why I'm so skeptical of that claim. "I've put the password in because otherwise it would've taken 6 hours" makes no sense at all - even putting aside my napkin calculation; if it would've taken an afternoon of crunching, why wouldn't you just have done that?
- dylan604 4y agobecause 6+ hours is too hard for a 140 char limit generation of people looking to get internet traffic to a blog while the content is still fresh in people's minds posted before anyone else does it.