Hacker News new | past | comments | ask | show | jobs | submit login

I don't question your memory, that is not my point. How long do you think it takes to crack a password that consists of digits of Pi or anything derived from it? And it's not about Pi either, it's just that you can't beat a computer in that regard.

For me, playing around with hashcat, was an eye opening experience and I truly believe in the Schneier quote from above.




Create a 10 word diceware passphrase, using the EFF's list. Try to memorize it, it shouldn't take long. Hash it with whatever hash you like. Even MD5. Try to crack it with Haschat. Spend as much time and/or money as you like on the project. It's got over 128 bits of entropy, you won't succeed before the Sun becomes a red giant and incinerates the Earth.


I agree with Schneier's quote, but you're also forgetting about password hashing. If it takes 10 seconds to derive the key (assuming the use of a strong hash function), anything with a good enough amount of entropy (60-90 bits) should be fine.

When an attacker acquires a leaked database, they're not cracking high entropic passwords.


Yes, what speaks for dheera's method is the use of a strong KDF and especially (a point that I missed initially) that they use a truly random master password.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: