3 ms·
If you can crack a single 52bit password in an hour, that's suggesting you can crack a 40bit password every second. That's 1 trillion hashes per second.
by conradludgate 2y ago
If you can crack a single 52bit password in an hour, that's suggesting you can crack a 40bit password every second. That's 1 trillion hashes per second.
- otabdeveloper4 2y agoSalts and timeouts made that password cracking technique obsolete anyways.
- dumbo-octopus 2y agoOnly for online access. Offline access is still a thing, and in no way "obsolete".
- dumbo-octopus 2y ago350B H/s was achieved in 2012 on consumer hardware. That's over 12 years ago, and several lifetimes of GPU improvements ago. 4 diceware words is simply not appropriate for anything remotely confidential, and it is bad for the community to pretend otherwise. https://theworld.com/~reinhold/dicewarefaq.html https://theworld.com/~reinhold/dicewarefaq.html
- conradludgate 2y agoIf you read the sources, that's 350B _sha1_ hashes per second... While you can't be sure what hash system is being used for your passwords, any respectable system using a modern password hash is not even close to being that fast. OWASP's recommended 600000 rounds of pbkdf2 performs 1.2 million sha2 block rounds IIRC. If we assume that sha1 and sha2 are equivalent in performance, then you're looking at only 290,000 password attempts a second. If the password system uses argon2 with a high memory requirement, you're in an even better position
- dumbo-octopus 2y agoCertainly if we assume the system under question was deigned with heightened security in mind, we will determine ourselves to be in a more secure system. But go on, use a 52 bit password – see what I care. But don't come crying to me when an institution with the smallest amount of funding was able to crack your vault.