Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I find the idea incredibly stupid. If I know someone who used that precise generator to produce his password. Then I know that the generator has less than 2000 words in the dictionnary. It then takes me only a few minutes to guess his password, rather than 550 years.

Conclusion: Don't ever use this password generator, write you own, and tell no-one about it.



  4b02d9f6353a8f36fbb092f040d5a31cdf6841f2

You up for a challenge? I just generated a pass phrase with this generator, and hashed it with SHA-1 (echo -n ... | sha1sum), no salting or anything else special. Feel free to brute force it.


I wrote this piece of code: https://gist.github.com/1149417

It's currently running at 3200000 tries per second on my Xeon machine. I am probably going to get bored before I find the right combination because I calculated it could take up to 52 days. :)

But anyways, it is still a lot less time than trying to bruteforce something like Tr0ub4dor&3 in my opinion.

It seems you like challenges, if I gave you a SHA1 hash of something similar to "Tr0ub4dor&3", would you be able to crack it (without rainbow table) under 52 days ? I don't think so.


Let's say the dictionary only has 1000 words in it. A phrase of four words in a row from that is still 1,000,000,000,000 possibilities, which is going to take you significantly more than a few minutes to work through at 1000 tries per second.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: