4 ms·

That should also mean that ca 50-52 character usernames are likely easily bruteforcable. Which makes the preconditions wider than those stated in the publicatio

by 3np 2y ago

That should also mean that ca 50-52 character usernames are likely easily bruteforcable. Which makes the preconditions wider than those stated in the publication.

fanf2 2y ago
50 letters is 235 bits which is not at all bruteforceable.
- akerl_ 2y ago
  They’re saying that if a username is 50 characters, only 2 characters of the password are used to in the cache key. And a 2 character password is very bruteforceable.