News for hackers. Stuff that matters.

A comment on New 25 GPU Monster Devours Passwords In Seconds.

Re:New 25 GPU Monster Devours Passwords In Seconds by akulbe on Wednesday December 05, 2012 @02:40AM (#4875365)
I wonder what algorithm 1Password uses, and how it would fare, compared to the other options.
[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by mileswu on Wednesday December 05, 2012 @02:44AM (#4875371)
It encrypts all your passwords using AES with a 128 bit key derived from your master password (PBKDF2) [1].

This is very different to what the article is talking about, since it encrypts your passwords, but the article talks about hashing which is one-way.

[1] http://help.agilebits.com/1Password3/agile_keychain_design.h...

[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by xorgar831 on Wednesday December 05, 2012 @03:01AM (#4875394)
The problem with PBKDF2 however is that if you pick a weak password it's useless. It would be better if they included an option for a key as well like other password safes do.
[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by dfc on Wednesday December 05, 2012 @03:41AM (#4875462)
"The problem with INSERT-SOMETHING however is that if you pick a weak password it's useless"

When is this not the case?

[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by schlomie28 on Wednesday December 05, 2012 @12:10PM (#4877208)
When you have a key as well.
[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by DanBC on Wednesday December 05, 2012 @04:12AM (#4875535)
> It would be better if they included an option for a key as well like other password safes do.

I would love to see research about the use of keys and passphrases. Especially, do people who have a key then chose a weaker master password?

[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by nwh on Wednesday December 05, 2012 @03:47AM (#4875475)
If you are genuinely interested in testing your 1Password keychain, the Jumbo builds of JTR include support for the agilekeychain, and some branches (Magnum Jumbo for example) offer OpenCL support for even faster attacks.

I tried it against mine, and was significantly disappointed in how quickly even my laptop could attack it. I promptly increased the complexity of my master password.

[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by newman314 on Wednesday December 05, 2012 @08:27AM (#4876106)
What was it before (key length)? And what is it now?
[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by nwh on Wednesday December 05, 2012 @08:40AM (#4876154)
It used to be random alphanumeric, eight characters. JTR tore through that. It's now ~15 random characters, not all ASCII.

Possibly worse, 1Password used to have a mistake in their key generation algorithm that means you could verify a password without the time-consuming key stretching, effectively making it thousands of times faster to crack. JTR doesn't use that method though.

[ Parent | on HN ]