Hacker News new | ask | show | jobs
by conradludgate 742 days ago
If you read the sources, that's 350B _sha1_ hashes per second... While you can't be sure what hash system is being used for your passwords, any respectable system using a modern password hash is not even close to being that fast. OWASP's recommended 600000 rounds of pbkdf2 performs 1.2 million sha2 block rounds IIRC. If we assume that sha1 and sha2 are equivalent in performance, then you're looking at only 290,000 password attempts a second.

If the password system uses argon2 with a high memory requirement, you're in an even better position

1 comments

Certainly if we assume the system under question was deigned with heightened security in mind, we will determine ourselves to be in a more secure system.

But go on, use a 52 bit password – see what I care. But don't come crying to me when an institution with the smallest amount of funding was able to crack your vault.