Specifically, a bcrypt hash with the cost set to 10, i.e. 32,768 iterations of hashing. If you are choosing an algorithm, consider Argon2id .
Nvidia RTX 5090 can crack an 8-digit passcode in just 3 hours — password cracking benchmarks show tremendous performance
Submitted 6 days ago by cm0002@lemmy.world to cybersecurity@infosec.pub
carl_dungeon@lemmy.world 6 days ago
Digit being the key here- alphanumeric with mixed case and symbols takes a dozen cards over 160 years.
tal@lemmy.today 6 days ago
To be fair, that assumes complete exhaustion of the password space. If you assume that a given password is totally random, then it’d take half that time, 80 years, on average.
Thing is, most people don’t choose totally random passwords, and there are utilities that will try to generate statistically-more-common passwords sooner in that sequence.
I’m probably very out-of-date here, but as an example, one elderly utility, John the Ripper*, comes with “mangling rules” to append a “1” at the end of a given sequence fairly early, because that’s how a lot of people make their password pass a digits requirement.
I’d guess that today, someone probably has software that has rules to order its attempts that are trained off leaked password databases to be statistically optimal to defeat them, rather than merely manually crafted with human guesswork.
carl_dungeon@lemmy.world 6 days ago
Totally fair points! Password managers FTW, all my passwords are 25 character complete random.
JordanZ@lemmy.world 5 days ago
This comes to mind from your ripper comment.
Cyber@feddit.uk 6 days ago
Yeah, I tried cracking my own pass_phrase_ once… it was doing well until it got to (I think) digit #9 and showed it would take another year…