News for hackers. Stuff that matters.

A comment on Flaw has Microsoft Authenticator overwriting MFA accounts, locking users out. Parent comment

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by Dylan16807 on Saturday August 17, 2024 @10:32PM (#41279697)
> Using 4 or more dictionary words provides excellent password security

I would not call 44-48 bits "excellent". It works if there's a good password hash being used, but if someone left PBKDF on basic settings then a GPU might be able to do 50 million guesses per second, or for a plain old salted hash 50 billion guesses per second.

[ Parent | on HN ]
Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by norgie on Sunday August 18, 2024 @01:22AM (#41280290)
How does that math work?
[ Parent | on HN ]
Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by Dylan16807 on Sunday August 18, 2024 @01:35AM (#41280332)
The bits, I'm assuming a list of about 2k-4k words. The XKCD example is 2k, so 11 bits per word.

The guesses per second, I looked up some hashcat benchmarks to get a rough range.

[ Parent | on HN ]