undefined | Better HN

Skip to content

Top Best Ask Show New Jobs

0 pointspilom12y ago0 comments

Modern password crackers are pulling all of wikipedia and youtube for seed words. If your words are in either of those, don't expect the password to stand to a dedicated attacker

0 comments

6 comments · 2 top-level

riquito12y ago· 4 in thread

There are 1160290625000000000000000 combinations of 5 words with a dictionary of 65000 words. That's not brute-forceable. If you take existing phrases it's another story, but random words works well.

pilomOP12y ago

Being a little loose with my estimates and a bit of Fermi Math, thats only about 300 years of computing time on a small home built GPU cluster.

Basically tells me that 4 random words are definitely crackable and 5 are theoretically possible (and definitely doable with 5-10 years of Moore's law)

dllthomas12y ago

lg(65k^4) is very nearly 64. If you worry about 4 random words being brute forced, you should worry about 64 bit symmetric keys being brute forced. I don't know where the current recommendations come down on that.

elwell12y ago

not sure what your calculation is, but permutations is what you should have calculated.

woqe12y ago

His calculation was (65000 Choose 5) * 5!. His premise required a combination then a permutation.

dllthomas12y ago

If you're picking with structure (including "phrases that spring to mind"), agreed. If you genuinely include enough entropy, then it doesn't much matter what mnemonics you layer on top.

j / k navigate · click thread line to collapse