Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have an Adobe account which, as you might have heard have recently had a breach may have had there encrypted passwords stolen.

The password for that account was not used else where, which is good, but it got me thinking, how easy is it for some one to decrypt the passwords once they have them ?

Obviously it hard to say unless you know the encryption level / method, but could someone give some real world examples, ie. if it was encrypted this way you would have to do x number of processing hours to decrypt it.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Unfortunately that "x numbers of hours" also highly depends on the hardware and encryption/hashing technology used.

Check this page from hashcat - http://hashcat.net/oclhashcat-plus/ as they have some "benchmark" based on some hardware that they have tested, and their results to give you some idea.

The better their hardware - more combination per seconds can be tested.

Edit: Also some information from grc.com --> https://www.grc.com/haystack.htm which gives you some idea how hard it is to break a long password, high-entropy password. And also some information about what make password hard to crack (in short: length - for full story, go to the site and have a bit of read).

share|improve this answer
    
Thanks @Darius, just reading through those now, one question when you say 'length' do you mean the length of the original password or the length of the encrypted string its turned into ? –  sam Oct 5 '13 at 17:06
    
@Sam Its the length of the original password. If you try to use the page - entering 8 digit password with full entropy (eg. Qw3rty:0) only take an approximate 18 hours - brute force - which means attempting every single combination of characters from 1 digit all the way to 8 digits, including combination of upper, lower, number, and special characters. When you increase the length of your password to 9 - it became 2 months. And 10 is 19 years - with assumption of 'normal' hardware. If you have a fully dedicated hardware (See the Massive Cracking line) it will take 1 week. And worse when longer –  Darius Oct 5 '13 at 18:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.