BloodFeastMan Additionally, your password will be mixed with a "salt" during keystream generation, a random bunch of characters created by the software that will make the use of rainbow tables almost useless; the same password will hash out to the same value, so a crappy password like "password", while it will create a long and impressive looking keystream, is still a crappy password
got it. "password" as a password get's a long stream, so as you said a crazy 300+ password would get a jetstream the circled the a preposterous amount of times.
Harvey Keeping in mind that graph is using 12x 4090s. You are not worth the effort.
17 lowercase letters (13 billion years???!!) is the key to digital immortality. I've been keeping the 9-11 length on the yellow orange side..in 33,000 years I will be hacked. 🙂.
Harvey but at a certain point you are increasing the difficulty to brute force way beyond what is reasonably possible.
I did not know the brute force tools had these limitations. Will White Hat vs Black be a game of narrowing the margin by a few decades a la a chess game? rhetorical. fantastic context.
Axios So if it is a short or long password the hash is the same length.
Using Long passwords is to keep the password crackers at bay
now I see that. 17 with a modest (lowercase) seems like the sweet spot for 10 lifetimes..
Axios Entropy chi etc is always a issue somewhere I got programs to test that stuff and it can really opens
ones eye on how good encryption is.
that stuff really interests me--entropy is basically past tense kind of. I found this at stack that blew my mind:
"We define the entropy as the value $S$ such the best guessing attack will require, on average, $S/2$ guesses. "Average" here is an important word. We assume that the "best attacker" knows all about what passwords are more probable to be chosen than others, and will do his guessing attack by beginning with the most probable passwords. The model is the following: we suppose that the password is generated with a program on a computer; the program is purely deterministic and uses a cryptographically strong PRNG as source of alea (e.g. /dev/urandom on a Linux system, or CryptGenRandom() on Windows). The attacker has a copy of the source code of the program; what the attacker does not have is a copy of the random bits that the PRNG actually produced."
the last 3 sentences way over my head. PRNG is the stream so to speak?
It gets far more mathematical than that I read Harvey's graph really spells it out as far as odds.
When I think of blackhat stuff too long I get a knot in my stomach.
But I think its safe to say that all the 12345 or 69apple or joeblow or 1985lumber or newyorkjets25----all that kind of stuff is the instant low-hanging fruit and people that guard their back accounts with this will get popped first...there is either a world of about-to-be-hacked ILOVETHESTONES because password-cracking has not seemed to keep up with 17 lowercase letters....
...by that metric 350 characters seems excessive, but not judging
@Harvey @Axios @BloodFeastMan you gents held a clinic and I'm enlightened for it.
