News for hackers. Stuff that matters.

A comment on New 25 GPU Monster Devours Passwords In Seconds. Parent comment

Re:New 25 GPU Monster Devours Passwords In Seconds by nwh on Wednesday December 05, 2012 @03:47AM (#4875475)
If you are genuinely interested in testing your 1Password keychain, the Jumbo builds of JTR include support for the agilekeychain, and some branches (Magnum Jumbo for example) offer OpenCL support for even faster attacks.

I tried it against mine, and was significantly disappointed in how quickly even my laptop could attack it. I promptly increased the complexity of my master password.

[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by newman314 on Wednesday December 05, 2012 @08:27AM (#4876106)
What was it before (key length)? And what is it now?
[ Parent | on HN ]
Re:New 25 GPU Monster Devours Passwords In Seconds by nwh on Wednesday December 05, 2012 @08:40AM (#4876154)
It used to be random alphanumeric, eight characters. JTR tore through that. It's now ~15 random characters, not all ASCII.

Possibly worse, 1Password used to have a mistake in their key generation algorithm that means you could verify a password without the time-consuming key stretching, effectively making it thousands of times faster to crack. JTR doesn't use that method though.

[ Parent | on HN ]