<html><head></head><body>haha. that password featured in many password leaks and is now probably No 3 in dictionaries after 123456 and Password1.<br>I think it's really a problem if unencrypted hashes have been stolen in which case all users are screwed regardless of their password complexity.<br><br><div class="gmail_quote">On 16 April 2019 10:37:27 BST, J via Nottingham <nottingham@mailman.lug.org.uk> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hello folks,</div><div><br></div><div>I thought I would terrify everyone with some figures I have recently come across.</div><div><br></div><div>
<div>Remember this?
<a href="https://xkcd.com/936/" title="http://xkcd.com/936/" target="_blank" rel="noreferrer noopener">https://xkcd.com/936/</a>
</div><div><font size="2">The claim is that "CorrectHorseBatteryStaple" is
<font size="2">2^44 of entropy</font>
and would take 550 years to crack.</font></div><div><font size="2">But how long would it take really? How terrifying is 87 seconds at <i>200 billion per second</i>.</font></div><div><font size="2">And what does one need to get that rate? Highly specialised ASICs managed by a fleet of supercomputers?</font></div><div><font size="2">No. How's about some commodity GPUs (8 GTX1080) and software from GitHub:</font></div><div>
<ul><li><font size="2"><a href="https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40">https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40</a></font>
</li><li><font size="2"><a href="https://github.com/hashcat/hashcat">https://github.com/hashcat/hashcat</a><br></font></li></ul></div>I shudder to think what could be done with more modern GPUs.</div><div><br></div><div>This can all be defended against; salt, pepper, treacle (functions like Argon2 which are memory hard), layers (hashing again and again and again and...) etc. Luckily modern systems don't rely on just your password, which is why you often get then "Hey, we don't recognise this device" tpye check and the use of two-factor for many things.<br></div><div><br></div><div>Once you've done all that though, it can all be undone with a simple wrench:
<a href="https://xkcd.com/538/" title="http://xkcd.com/936/" target="_blank" rel="noreferrer noopener">https://xkcd.com/538/</a><br></div><div><br></div><div>J.<br></div></div></div></div></div>
</blockquote></div><br>--<br>vadim@mankevich.co.uk PGP key fingerprint<br>0xC046022A3A91455AF0C9BB2404BF882B1905C772<br>Retrieve from <a href="https://keybase.io/vmankevich">https://keybase.io/vmankevich</a><br><br>"When we take away the right to figure out if something bad is going on in our computers, the inevitable consequence is that bad things will happen in our computers." (Cory Doctorow)</body></html>