Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I dunno, I just did some back-of-the-envelope calculations and it seems to be okay:

With 8 high-end GPUs, we see a Blowfish speed of about 100 kilohashes per second. [0]

We assume we're cracking bcrypt strength 10, so we divide this number by 64 (2^10 ÷ hashcat's 2^4), and get about 1500 bcrypt checks-per-second.

There are about 170,000 words in the OED, and we choose 4 at random to give us 170_000^4 = 8.3521 * 10^20.

We can divide by 1500, but that still seems like a lot of seconds. (like, 3.5 ages of the sun)

[0]: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...



Unless the hash is in a cookie or something I probably couldn't guess it either within the lifetime of the sun etc.




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: