Timeline for How expensive is it to guess a 15 character password, and should I be worried?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 1, 2012 at 20:26 | comment | added | Bradley Kreider | You could also spend the $1,000,000 in a shorter amount of time using EC2 or some other cloud, but it's more cost effective to have your own hardware. I just wanted to point out the time-cost tradeoff isn't as big anymore. | |
| Feb 25, 2012 at 23:13 | history | edited | D.W. | CC BY-SA 3.0 |
fix some typos, switch to US notation
|
| Feb 25, 2012 at 23:09 | comment | added | D.W. | @CodeInChaos, you are right, my math went wrong somewhere and as a result my estimate was bogus. Thanks for the correction. | |
| Feb 25, 2012 at 15:26 | comment | added | CodesInChaos | @D.W. No idea how you got that number. I get 10 million CPU, or 4000 GPU years. But you're right that in most cases, planting a keylogger is cheaper than spending 1 million dollars to crack the password. It's also important that my calculations are based on standard graphics cards. I expect the per-crack costs for an attacker who developed custom hardware to be lower by a factor of 100 or so. I wouldn't be comfortable with 55 bits of entropy used with 1000 iteration PBKDF2. | |
| Feb 25, 2012 at 13:25 | comment | added | ewanm89 | @CodeInChaos lowercase is the correct term, I was using the term poster used in question ;) | |
| Feb 25, 2012 at 13:17 | comment | added | CodesInChaos | @ewanm I misread your comment as "underscore", and wondered why adding a character would reduce entropy. Never heard the word "undercase". | |
| Feb 25, 2012 at 13:15 | comment | added | ewanm89 | Exactly, lowercase only halves the number of characters in the set of alphabetic characters (26 less in the whole set), this it not so much for you as it is for the poster, mix in some uppercase and he has gone from 15*log2(36) to 15*log2(62). | |
| Feb 25, 2012 at 12:21 | comment | added | ewanm89 | point to note, undercase only will decrease entropy. | |
| Feb 25, 2012 at 9:12 | history | edited | CodesInChaos | CC BY-SA 3.0 |
deleted 2 characters in body
|
| Feb 24, 2012 at 17:58 | comment | added | user51166 | OK. If you put it that way it should be enough. In the future I plan on strenghtening it anyway, therefore I think for a year it's good enough. | |
| Feb 24, 2012 at 10:16 | history | answered | CodesInChaos | CC BY-SA 3.0 |