1Password GPU brute-force with 3M hash/s

Re:1Password GPU brute-force with 3M hash/s by jholman on Tuesday April 16, 2013 @07:00PM (#5561499)

I'm actually seeing N/4 in that hashcat.net/forum thread. See hashcat.net/forum/thread-2238-post-13424.html#pid13424 , or alternately just the last line of the original TFA, which says "reduce [work required] from 8000 to 2002".

I'm not sure how this is "least charitable", it seems to be pretty much the only interpretation. Either way, I'm not seeing the significance at all. I look forward to a reply from atom to penultimate post in that thread (#24) in which guinndupont explicitly asks for the real-world significance.

And I agree with Thomas and miles, that the vendor response is wonderfully direct, informative, reasonable, helpful, non-weaselly, etc. Props to him.

[ Parent | on HN ]

Re:1Password GPU brute-force with 3M hash/s by tptacek on Tuesday April 16, 2013 @07:10PM (#5561540)

I used the word "charitable" because the "N" in this measurement is a hypothetical measurement of how much more secure 1Password could have been. But if that's a valid analysis, it's just as valid to say they should have been using scrypt. Which, sure, but who cares?

[ Parent | on HN ]

Re:1Password GPU brute-force with 3M hash/s by aidenn0 on Wednesday April 17, 2013 @05:40AM (#5563542)

You're not still recommending PBKDF2 with FEAL4 GMAC? ;)

[ Parent | on HN ]

Re:1Password GPU brute-force with 3M hash/s by tptacek on Wednesday April 17, 2013 @12:00PM (#5565174)

Too fast on hardware. I now recommend PBKDF2-HMAC-RSA2048HASH.

[ Parent | on HN ]