I find that strip rather disappointing (even after correcting the URL so it works). Munroe usually does his homework better than that. 44 bits of entropy really isn't very much these days, and his estimate of 550 years to guess assumes a 1000 passwords per second testing rate, which is at least three orders of magnitude too low -- for a single CPU. Throw a thousand CPUs at it (not terribly difficult or expensive using Amazon or similar) and you can easily exceed a billion tests per second for many common password hashing algorithms.<div>
<div><br><div class="gmail_quote">On Sun, Apr 8, 2012 at 11:47 AM, Ted Rolle, Jr. <span dir="ltr"><<a href="mailto:stercor@gmail.com">stercor@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<font face="DejaVu Sans Mono"><a href="http://www.xkcd.cm/936" target="_blank">http://www.xkcd.cm/936</a><br>
<br>
</font><div class="im"><br>
On 04/08/2012 08:10 AM, Jeffrey Burdges wrote:
<blockquote type="cite">
There is an enormous risk of a rainbow table attack on the key
space by a malicious server, but maybe you could move the
proof-of-work to the key space side to reduce this. An independent
source picks a new key seed every n months, thus forcing the
searcher to hash their searches using all previous seeds, but
preventing the server from using rainbow tables as effectively. I
would also be interested in working on such a weakly secure search
infrastructure project. I'm rather surprised that nobody has built
this or similar yet actually, it's trivial conceptually and not
too hard to implement. Jeff Burdges
_______________________________________________
tahoe-dev mailing list
<a href="mailto:tahoe-dev@tahoe-lafs.org" target="_blank">tahoe-dev@tahoe-lafs.org</a>
<a href="https://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev" target="_blank">https://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev</a>
</blockquote>
</div></div>
<br>_______________________________________________<br>
tahoe-dev mailing list<br>
<a href="mailto:tahoe-dev@tahoe-lafs.org">tahoe-dev@tahoe-lafs.org</a><br>
<a href="https://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev" target="_blank">https://tahoe-lafs.org/cgi-bin/mailman/listinfo/tahoe-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>Shawn<br>
</div></div>