5 ms·

Well, we also know they didn't crack a random 20 character password. But some people appear to be panicking as if they did.

Aeolun 4y ago
You know this because you think it is mathematically impossible?
- mr_mitm 4y ago
  Not mathematically, but physically. You need astronomical quantities of energy. Bruce Schneier pointed this out in "Applied Cryptography" (1996): https://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html https://www.schneier.com/blog/archives/2009/09/the_doghouse_... (unfortunately the exponents are not displayed correctly here) > One of the consequences of the second law of thermodynamics is that a certain amount of energy is necessary to represent information. To record a single bit by changing the state of a system requires an amount of energy no less than kT, where T is the absolute temperature of the system and k is the Boltzman constant. (Stick with me; the physics lesson is almost over.) >Given that k = 1.38×10-16 erg/°Kelvin, and that the ambient temperature of the universe is 3.2°Kelvin, an ideal computer running at 3.2°K would consume 4.4×10-16 ergs every time it set or cleared a bit. To run a computer any colder than the cosmic background radiation would require extra energy to run a heat pump. >Now, the annual energy output of our sun is about 1.21×1041 ergs. This is enough to power about 2.7×1056 single bit changes on our ideal computer; enough state changes to put a 187-bit counter through all its values. If we built a Dyson sphere around the sun and captured all its energy for 32 years, without any loss, we could power a computer to count up to 2192. Of course, it wouldn’t have the energy left over to perform any useful calculations with this counter. >But that’s just one star, and a measly one at that. A typical supernova releases something like 1051 ergs. (About a hundred times as much energy would be released in the form of neutrinos, but let them go for now.) If all of this energy could be channeled into a single orgy of computation, a 219-bit counter could be cycled through all of its states. >These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.
  - mock-possum 4y ago
    They could have gotten lucky of course.
    - D13Fd 4y ago
      Yeah this person is saying “impossible” when they mean “extremely improbable.”
      - mr_mitm 4y ago
        Let's just say the probability is negligible.
  - Aeolun 4y ago
    I’m not sure how we go from 20 character string to 256 bits? Guessing the 20 character string is a lot more likely than cycling through every state of a 256 bit key.
chaxor 4y ago
At some level it's extremely likely that this is all that ever needs to be done, even if the password needed to be cracked is 300 characters long and completely random. The likely case is that this password is in a password vault, which is either 1) online managed by a company (in which it's easy to see that it's inevitable to be leaked or cracked, given the news we've seen from these companies) or 2) it's on a local device and still has a simple password to get access to all passwords. It's extremely unlikely that someone has a completely random password that is >40 characters long for the password manager.

Aeolun 4y ago

You know this because you think it is mathematically impossible?

mr_mitm 4y ago
Not mathematically, but physically. You need astronomical quantities of energy. Bruce Schneier pointed this out in "Applied Cryptography" (1996): https://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html https://www.schneier.com/blog/archives/2009/09/the_doghouse_... (unfortunately the exponents are not displayed correctly here) > One of the consequences of the second law of thermodynamics is that a certain amount of energy is necessary to represent information. To record a single bit by changing the state of a system requires an amount of energy no less than kT, where T is the absolute temperature of the system and k is the Boltzman constant. (Stick with me; the physics lesson is almost over.) >Given that k = 1.38×10-16 erg/°Kelvin, and that the ambient temperature of the universe is 3.2°Kelvin, an ideal computer running at 3.2°K would consume 4.4×10-16 ergs every time it set or cleared a bit. To run a computer any colder than the cosmic background radiation would require extra energy to run a heat pump. >Now, the annual energy output of our sun is about 1.21×1041 ergs. This is enough to power about 2.7×1056 single bit changes on our ideal computer; enough state changes to put a 187-bit counter through all its values. If we built a Dyson sphere around the sun and captured all its energy for 32 years, without any loss, we could power a computer to count up to 2192. Of course, it wouldn’t have the energy left over to perform any useful calculations with this counter. >But that’s just one star, and a measly one at that. A typical supernova releases something like 1051 ergs. (About a hundred times as much energy would be released in the form of neutrinos, but let them go for now.) If all of this energy could be channeled into a single orgy of computation, a 219-bit counter could be cycled through all of its states. >These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.
- mock-possum 4y ago
  They could have gotten lucky of course.
  - D13Fd 4y ago
    Yeah this person is saying “impossible” when they mean “extremely improbable.”
    - mr_mitm 4y ago
      Let's just say the probability is negligible.
- Aeolun 4y ago
  I’m not sure how we go from 20 character string to 256 bits? Guessing the 20 character string is a lot more likely than cycling through every state of a 256 bit key.

chaxor 4y ago

At some level it's extremely likely that this is all that ever needs to be done, even if the password needed to be cracked is 300 characters long and completely random. The likely case is that this password is in a password vault, which is either 1) online managed by a company (in which it's easy to see that it's inevitable to be leaked or cracked, given the news we've seen from these companies) or 2) it's on a local device and still has a simple password to get access to all passwords. It's extremely unlikely that someone has a completely random password that is >40 characters long for the password manager.