Timeline for How difficult to crack keepass master password?
Current License: CC BY-SA 3.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 12, 2019 at 22:18 | comment | added | Hugo | For some extra security, Keepass allows you to automatically calculate the amount of iterations in such a way that it takes exactly one second on the current computer to open or save the database. That's well within acceptable time limits and makes brute forcing completely infeasible. | |
| Nov 6, 2016 at 23:04 | comment | added | Bob | @Dexter The use of a "cluster" is just throwing more hardware at the problem. 50 million years with one computer would be approx one year with 50 million computers (some assumptions, e.g. that you can evenly distribute the work... and that you have access to that many powerful computers). If you want more modern AES-NI figures, 2x-5x. Overall, maybe 10 million computer-years. | |
| May 14, 2016 at 6:56 | comment | added | Dexter | @Tom Leek , Can you update this 25 million year thing with current technology ? Say using clusters ? | |
| Nov 22, 2015 at 10:24 | comment | added | Aleksandr Dubinsky | @Iszi I simply observed that the answer is low on information. | |
| Nov 18, 2015 at 20:13 | comment | added | Iszi | @AleksandrDubinsky Ok, so let's assume GPUs and some slick optimizations can increase performance by an order of magnitude. That's still 2.5 million years. And even then, only if you're using 2 PCs. | |
| Oct 30, 2015 at 19:47 | comment | added | Aleksandr Dubinsky | This answer does not demonstrate knowledge of how fast KeePass passwords can be cracked in practice. The answer also ignores GPUs. | |
| Sep 3, 2013 at 10:25 | comment | added | Simon East | Keepass has an excellent feature where you can set the number if iterations based on how many your CPU can perform in 1 second. So this means that you wait 1 second for it to decrypt your data, but it limits brute-force attacks to 1 per second, which would discourage most attempts. | |
| Mar 22, 2012 at 2:59 | comment | added | recluze | @DoNuT If it's your own password, you don't have to brute force it. You will have a LOT of information about what kind of passwords you keep, do you put numbers in, do you remember any specific characters (or password length)? All of them can be used to bring down the time immensely. It only takes 25 million years if you want to break someone else's password (and they can't even be "social-engineered"). | |
| Mar 15, 2012 at 18:46 | comment | added | user8469 | You just killed my hopes in recovering the password of my own Keepass store in at least a few days... I especially loved the 25 million year thing, but that would just work if both are trying different offsets, otherwise they'd just do the same work twice... just sayin'. :D | |
| Oct 29, 2011 at 5:24 | comment | added | woliveirajr | +1 for the "with two PC that's only 25 mi..." | |
| Oct 28, 2011 at 22:19 | vote | accept | steampowered | ||
| Oct 28, 2011 at 19:43 | history | answered | Tom Leek | CC BY-SA 3.0 |