News for hackers. Stuff that matters.

A comment on New 25 GPU Monster Devours Passwords In Seconds. Parent comment

Re:New 25 GPU Monster Devours Passwords In Seconds by mileswu on Wednesday December 05, 2012 @02:44AM (#4875371)
It encrypts all your passwords using AES with a 128 bit key derived from your master password (PBKDF2) [1].

This is very different to what the article is talking about, since it encrypts your passwords, but the article talks about hashing which is one-way.

[1] http://help.agilebits.com/1Password3/agile_keychain_design.h...

[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by xorgar831 on Wednesday December 05, 2012 @03:01AM (#4875394)
The problem with PBKDF2 however is that if you pick a weak password it's useless. It would be better if they included an option for a key as well like other password safes do.
[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by dfc on Wednesday December 05, 2012 @03:41AM (#4875462)
"The problem with INSERT-SOMETHING however is that if you pick a weak password it's useless"

When is this not the case?

[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by schlomie28 on Wednesday December 05, 2012 @12:10PM (#4877208)
When you have a key as well.
[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by DanBC on Wednesday December 05, 2012 @04:12AM (#4875535)
> It would be better if they included an option for a key as well like other password safes do.

I would love to see research about the use of keys and passphrases. Especially, do people who have a key then chose a weaker master password?

[ Parent | on HN ]