[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAKDRQS7Y-LhHCjzJhAoUKCeBK11-8ZdapQc4Ed0gT8nB8dP3pw@mail.gmail.com>
Date: Fri, 10 Nov 2023 23:11:14 +0000
From: Jimmy Yuen Ho Wong <wyuenho@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: 1password memorable passwords
Thanks, judging from the 16k iteration cost of the hash, even if I only try
to crack a 3 word phrase, it's still going to take at least half a century
to brute force. I think I'm going to give up now.
Jimmy
On Thu, Nov 9, 2023 at 10:37 PM Solar Designer <solar@...nwall.com> wrote:
> On Thu, Nov 09, 2023 at 09:16:31PM +0000, Jimmy Yuen Ho Wong wrote:
> > That's what I'm doing now with a simple Rust program generating 3 word
> > combos. I'm only hitting around 1300 tries per second with
> > --format=dmg-opencl on my MBP M1 Pro 32GB, does that sound about right?
> How
> > many more tries can I get if I rent a beefier machine on the cloud?
>
> Like Matt correctly wrote, "if you can't remember more of your password,
> you probably are not going to be able to crack it." The password space
> is just too large (you said 2^56) and the speed too low.
>
> As to the specific speeds, they depend not only on the hardware, but
> also on the iteration count used by your specific file. It is printed
> by "john", as in a screenshot currently at the bottom of this page:
>
> https://www.openwall.com/john/cloud/
>
> On that page, you can also get text files with benchmark results on
> various AWS instances. For example, for p3.2xlarge we have:
>
> Benchmarking: dmg-opencl, Apple DMG [PBKDF2-SHA1 3DES/AES OpenCL]...
> LWS=32 GWS=40960 (1280 blocks) DONE
> Speed for cost 1 (iteration count) of 1000, cost 2 (version) of 2 and 1
> Raw: 1743K c/s real, 5032K c/s virtual
>
> This is for 1000 iterations, like ancient DMG files used. If your file
> isn't that ancient, it's probably using something like 150000 iterations,
> so the speed would be roughly 150 times lower, or around 10k per second.
> That's around 10 times faster than you have on the MBP, but still by far
> not fast enough. At that kind of speed, you'd need a hundred thousand
> years to search the password space exhaustively, or you'd have something
> like a 0.0005% chance of cracking your password in a year.
>
> These are approximate numbers, but they should set the expectations.
>
> Alexander
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
