Thanks for your reply, Moxie! How would cloudcracker fare against the four-word combos recently popularized by xkcd[1]? Even if it were known that the password was made up of four English words, what sort of time frame might it require to crack?
A single ATI 5970 can compute 2300M SHA-1 hashes per second. So you're looking at about two and a half hours to run through the entire keyspace. Fewer on a farm (which Amazon will rent to you for a few bucks). That's assuming you know the dictionary, of course.
Of course, if the password is hashed with bcrypt or scrypt it will take much longer, although I'm not sure how to do that calculation.
That's a little faster than howsecureismypassword.net's estimate (154 octillion years on a desktop PC to crack "correct horse battery staple" (without quotes)).
Each of those sets will bring you up in entropy, from two quadrillion up to nine quintillion permutations. That would take the ATI 5970 about 4306184595 seconds, or 136.4 years. If you spread that out over 100 cards that would only take you 1.3 years to crack.
Maybe that's too close to call, so you can always change your password every 60 days to mitigate people with more money/time on their hands. If anyone ever wants my password that bad they should just give me the money they'd spend on cracking and i'll give them my password ;)
$ cat final/english-words.* | perl -le'@wl=map{ s/\s//g; tr/A-Z/a-z/; (/^[a-z0-9]+$/ and length$_ > 3 and length$_ < 7) ? $_ : () } <>; push @a, $wl[int rand(@wl)] for 1..4; print "@a"'
rymmes weekly calvin cimbalWhat I recommend is that people use diceware (http://www.diceware.com) to create a six-word passphrase, which they use to secure a password manager. Then use the password manager to generate random 12-character (alpha+numeric+symbol) passwords for each login.