3 ms·
Given a passphrase dictionary attack, the passphrase would be discovered in less than a minute. Wait, what? 2,048^4 == 2^44 == 17,592,186,044,416 At 2 millio
by leot 14y ago
Given a passphrase dictionary attack, the passphrase would be discovered in less than a minute.
Wait, what?
2,048^4 == 2^44 == 17,592,186,044,416
At 2 million hashes/second it would still take 101 [edit: actually, on average, 50] days to find this password, if it was unsalted. Perhaps if you had spent a few years of supercomputer time to generate some massive rainbow tables, you might be able to discover it quickly, but absent the need for your linkedIn password to be resistant to attacks from a nation state, you'd be pretty safe with such a password for a while.
It's entirely unclear how you came to the conclusion that it could be discovered in "under a minute" with a passphrase dictionary attack.
- rphlx 14y agoDiverging from your main point a bit: 2MH/s is unrealistically low. For a couple thousand dollars you can build FPGA HW that can do several billion SHA1 hashes/s. The bitcoin mining world is getting 400-450 SHA256 MH/s from a $130 chip. With similar technology, you can brute force a 2^44 SHA1 space in a lot less than 50 days.
- bostonvaulter2 14y agoWhich is why no-one should be storing passwords in SHA1.