Hacker News Reader

I dunno, I just did some back-of-the-envelope calculations and it seems to be okay:

With 8 high-end GPUs, we see a Blowfish speed of about 100 kilohashes per second. [0]

We assume we're cracking bcrypt strength 10, so we divide this number by 64 (2^10 ÷ hashcat's 2^4), and get about 1500 bcrypt checks-per-second.

There are about 170,000 words in the OED, and we choose 4 at random to give us 170_000^4 = 8.3521 * 10^20.

We can divide by 1500, but that still seems like a lot of seconds. (like, 3.5 ages of the sun)

Unless the hash is in a cookie or something I probably couldn't guess it either within the lifetime of the sun etc.

It's got 80-120 ish bits of entropy, why is it not secure?

(Assuming you're not referring to it literally being a well known password from a web comic.)

Not the parent poster, but prior objections I've seen are that people don't do a good job at picking random words and four words is too few.

I assumed they meant using a diceware-like system to choose instead of literally making up words

> I have some bad news for you

Can you expand on that?