4 ms·
> ...or to try brute forcing the password offline, which has a reasonable probability of working. Either way, it is not any different than the situation with Hu
by AaronFriel 13y ago
> ...or to try brute forcing the password offline, which has a reasonable probability of working. Either way, it is not any different than the situation with Hushmail, and I would put both squarely in the "snake oil" category.
You have an awfully high standard of what you define as "snake oil" cryptography. If a brute force effort to derive the secret key constitutes snake oil, I have bad news for you regarding the state of crypto.
- betterunix 13y agoFirst of all, brute forcing the password is not needed unless the user fails to log in. The system is designed for the user to send the most important secret, on which the rest of the system's security depends, to a third party. That being said, brute forcing a password is not the same thing as brute forcing a secret key. The distribution of passwords that people can remember is not even remotely uniform, and the distribution of passwords that people actually use is even more heavily biased. Compare to GnuPG: the attacker needs access to your computer before he can even attempt to brute force your password or try to capture it.
- AaronFriel 13y agoBrute forcing an individual user's password can still be made an extremely costly operation with appropriate measures incorporated.