The contents of the GitHub repo are of course encrypted with your own key, which you need to manually sync to your other devices.
After some time with pass, I switched to a more integrated solution, with KeePassXC on desktops and Keepass2Android on mobile, with sync via OneDrive.
Ended up on Bitwarden (Vaultwarden in my closet really) instead for web passwords. Admin passwords stayed in pass because I want to be sure I have them. Git is local to the device even if the server burns down.
...
> 50 bits of entropy changes things a bit. Now it takes 1 year instead of 71 days
I don't understand this. Going from 40 bits to 50 bits increases the size of the search space by a factor of 1024. Why does it only increase the search time by a factor of 5?
On the reference page I linked it mentions:
> Having 40 bits of entropy is approximately 1,000 times weaker than 50 bits since bit strength scales exponentially. In other words, random bits are worth a lot because each additional truly random bit, on average, doubles the time required to crack.
71 days vs 365 days is about a 5x multiple. I'm not sure how all of that ties together.
The TL;DR is even with 100k+ iterations of PBKDF2 an attacker can crack a password with 40 bits of entropy in about 71 days if they had access to 200 modern GPUs. For comparison if there were only 1 iteration instead of 100k the same type of password could be cracked in 61 seconds.
50 bits of entropy changes things a bit. Now it takes 1 year instead of 71 days but if you're a high value target they can just ramp up the number of GPUs to reduce the time.
The difference between 40 and 50 bits of entropy for a password look like this:
The takeaway I got is you're probably ok if you have a really good password (150+ bits) with 100k+ iterations but if I were using Lastpass personally (which I'm not) I would absolutely re-roll everything and never use the product again. I personally use a command line tool called `pass` which stores everything locally. This story interests me though because I am mildly involved with someone who is using Lastpass and I suggested they re-roll everything. I'm happy to see someone did the math, it's the exact information I wanted to know.The podcast show notes are on page 6 which has more numbers and practical examples: https://www.grc.com/sn/SN-905-Notes.pdf