I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force apparently). And this is done to the point where claims are being made that having a master password isn't even worth it (https://palant.de/2018/03/10/master-password-in-firefox-or-thunderbird-do-not-bother).

I wanted to know how secure/in-secure a single SHA-1 iteration really is, but I am not completely sure I understand the math.

Aparrantly the RTX 2080Ti has 12 GH/s on SHA-1. So let's say I have 4 of those. That would be 48 billion hashes per second. Now let's also say I have a (randomly generated) password that allows for 77 different characters and has a total length of 14 characters. Would the following math be correct:

([number of allowed chars] ^ [password length]) / [hash rate per second] / [seconds in a minute] / [minutes in a hour] / [hours in a day] / [days in a year] = [maximum number of years required to crack password]
So that would be:

(77 ^ 14) / 48000000000 / 60 / 60 / 24 / 365 = 170146221

So that means (if I am getting my math right) that it would take 170 million years to crack a 14 characters long password?


Your math is correct, but you calculated the time needed to test all 14-character long passwords.

The cracking time could be anywhere between now and in 170 millions years, based on your luck.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy