4 ms·
Show HN: Correcthorsebatterystaple.net XKCD inspired password generator
- valarauca1 12y agousing 4 words + a number there are (with your dictionary). 272,063,514,907,720,560 possible combinations (2.7x10^17). I threw together a very rough cracker in java. That's able to do about ~40,000 guesses per second (i5 laptop processor). Based on your dictionary of 2284 words. At this rate it would take me 123,243 years to complete a full search of the space. :.:.: At the NSA's quoted rate 1 trillion guesses per second (Edward Snowden Citizen 4). It would take 3 days, 9 hours to crack (giving your dictionary).
- vvoyer 12y agoYou mean it would take the NSA 3 days given that they are able to test their solutions on my login system and my login system is able to take 1 trillion guesses per second?
- valarauca1 12y agoGiven the dictionary (all possible words) and using the default settings (4 words, hyphen, 1 number). If we did something simple like say SHA-256 the generated password. And compare this to the SHA-256 of a captured password. It would take ~3 days, knowing the generation algorithm and dictionary to solve for a match. :.:.: Also nobody in their right mind would actually preform 1trillion HTTP post/get requests per second. They'd compare hashes locally within memory. Far faster.
- sjs382 12y agoPresuming you know that someone is using this method, the number of words that they're using, what dictionary they are using, and whether they're using any punctuation. Keep adding variables (I didn't mention a few of the variables on the site) and it becomes more difficult.