It does technically scale, just like everything else :)

But I think the parent's point was that this compute time only lets you check one password against one account. All you can do, after this compute time, is state that "'monkey' is/ is not the correct password for @iagooar's account".

Those results can't be used to check other accounts (because they're salted) so this approach doesn't really scale well at all. It might, for a huge adversary (state-scale) allow a single password to be cracked in a reasonable timeframe, iff it's relatively simple password.

1 week only tests 1 password. It would have to run for years to get a decent set of results. I don't see how a company can afford all that hardware and power to do something that is illegal to begin with. How do they monetize it to get a return?

> I don't see how a company can afford all that hardware and power to do something that is illegal to begin with.

An evildoer would use stolen credentials, stolen credit cards, or stolen hardware (botnets).

And don't forget, that every 18 months, the amount of processing power you get for a modest price, doubles.

Not anymore.

It's hard to get specific numbers about a trend that just changed. But the double every 18 months is now clearly wrong.

We've got a couple of approximately 27 months doubling, but that is past too. My bet is that we won't get a fixed number ever again.

I'm not sure the fastest per core speed for the last 5 years in CPUs is significantly faster.. more cores, more caches for some operations, but not nearly the growth we used to see.

Well, I was surprised by these benchmarks: http://www.anandtech.com/show/10404/asrock-deskmini-110-mini... When you compare the skull canyon CPU and the i5 6500: http://ark.intel.com/compare/93341,88184 The i5 has better specs on pretty much any aspect, but the skull canyon does way better in those benchmarks. I am told the impact is the 128MB eDRAM which acts as a L4 cache.

So maybe that's the way for computers to become much faster, making everything around the CPU go faster. Integrate the RAM and the GPU on the chip. Superfast SSDs. Etc.

Let's say that were true, so in a year and half you will only have to spend 20 years cracking the passwords? Bcrypt is designed for this exact situation and performs pretty well.

I am not saying bcrypt is bad. But thruth is, we have to be constantly challenging our assumptions about security and avoid feeling like the battle is "won".

Still?

You just need to target certain accounts, no need for all.