Re:1Password GPU brute-force with 3M hash/s
by tptacek on Tuesday April 16, 2013 @06:11PM
(#5561274)
That's silly. Even in the least charitable interpretation of what's happened, 1Password's security margin went from N (where N was a hypothetical security level believed to have been achieved by 1Pw, not some objective standard) to N/2. N/2 in this case is still light years past salted hashes.
[ Parent
| on HN ]
Since N is generally measured in bits, I'd say it's reduced to N-1.
Re:1Password GPU brute-force with 3M hash/s
by tptacek on Tuesday April 16, 2013 @07:29PM
(#5561607)
Argh I wish I had thought to say that.
Re:1Password GPU brute-force with 3M hash/s
by nixarn on Wednesday April 17, 2013 @08:20AM
(#5563997)
True. And good thing knowing they are gonna make it better. I happened to find a license I got sometime with a bundle, so got it in use now.
Re:1Password GPU brute-force with 3M hash/s
by jholman on Tuesday April 16, 2013 @07:00PM
(#5561499)
I'm actually seeing N/4 in that hashcat.net/forum thread. See hashcat.net/forum/thread-2238-post-13424.html#pid13424 , or alternately just the last line of the original TFA, which says "reduce [work required] from 8000 to 2002".
I'm not sure how this is "least charitable", it seems to be pretty much the only interpretation. Either way, I'm not seeing the significance at all. I look forward to a reply from atom to penultimate post in that thread (#24) in which guinndupont explicitly asks for the real-world significance.
And I agree with Thomas and miles, that the vendor response is wonderfully direct, informative, reasonable, helpful, non-weaselly, etc. Props to him.
Re:1Password GPU brute-force with 3M hash/s
by tptacek on Tuesday April 16, 2013 @07:10PM
(#5561540)
I used the word "charitable" because the "N" in this measurement is a hypothetical measurement of how much more secure 1Password could have been. But if that's a valid analysis, it's just as valid to say they should have been using scrypt. Which, sure, but who cares?