1Password GPU brute-force with 3M hash/s

Re:1Password GPU brute-force with 3M hash/s by aspensmonster on Tuesday April 16, 2013 @06:25PM (#5561360)

I'd suspect it's a problem for people who think that, since it uses $fancy_encryption_scheme_they_cant_pronounce_or_understand, they can just use a trivially easy password for a computer to guess. Utilizing encryption isn't helpful if your password is still just "password1". I'm not a cryptographer by any means, but my general understanding is that longer is better. Picking some random nonsense sentence like "Correct horse battery staple" and using it as your password, is better than using "p455w0rd!1".

[ Parent | on HN ]

Re:1Password GPU brute-force with 3M hash/s by bradleyjg on Tuesday April 16, 2013 @06:42PM (#5561440)

There are multiple password cracking techniques. Under brute force longer is strictly better. However, there are sophisticated dictionary attack programs that are also seeded with leaked password lists and do a variety of clever substitutions to come up with many potential candidates from each base word. For that type of attack, a password like: passwordpasswordpasswordpassword may not be a great bet despite it's length.

[ Parent | on HN ]

Re:1Password GPU brute-force with 3M hash/s by lelandbatey on Tuesday April 16, 2013 @08:26PM (#5561810)

However, I'd assume a password like:

thisisthepasswordthatiwilluseonhackernews

would still be relatively hard to crack?

[ Parent | on HN ]

Re:1Password GPU brute-force with 3M hash/s by glomph on Tuesday April 16, 2013 @10:12PM (#5562238)

Not if they run through a dictionary of common words and include the site name in that dictionary. (Common practice)

[ Parent | on HN ]

Re:1Password GPU brute-force with 3M hash/s by _ikke_ on Wednesday April 17, 2013 @03:30AM (#5563207)

The search space grows exponentially with each additional word being added. With enough words, it gets infeasible to bruteforce.

[ Parent | on HN ]

Re:1Password GPU brute-force with 3M hash/s by pooriaazimi on Tuesday April 16, 2013 @07:25PM (#5561592)

@rorrr: You've been hellbanned for almost a month.

------------

His comment:

> It's nearly identical.

> There are around 170,000 english words (including all the obscure ones you've never heard and have no idea how to spell).

> Number of 4-word combinations:

    170,000^4 = 8.35 * 10^20

> Lowercase (26) + uppercase (26) + digits (10) + special characters (36) = 98 characters

   98^10 = 8.17 * 10^19

> An order of magnitude difference.

> And if they start bruteforcing with the simpler words (which you used in the example), there are only 5,000 - 10,000 of them, the number of your combinations drops dramatically:

    5,000^4 = 6.25 * 10^14

    10,000^4 = 10^16

> So unless you use very obscure words in your password, you are doing much worse than you think.

[ Parent | on HN ]

Re:1Password GPU brute-force with 3M hash/s by danparsonson on Wednesday April 17, 2013 @05:08AM (#5563461)

> You've been hellbanned for almost a month

For good reason; please check someone's comment history before advising them of this.

[ Parent | on HN ]

Re:1Password GPU brute-force with 3M hash/s by fryguy on Tuesday April 16, 2013 @08:03PM (#5561731)

Well 2^48 ~= 2.8 x 10^14, so it's not as bad as you think for the simple words version (which is the same as 8 characters chosen from 64 choices)

[ Parent | on HN ]