Jan 17, 2004 15:28
My prototype, if run on a five-letter password with absolutely no time needed to check correctness, can crack it within 8 minutes, 40 seconds. My TRT is estimated in the thousands of days for a 9-letter password, but I'm sure that's much less than the real time. Tell ya what: if you want to know exactly how safe your HTTP password is from my program, multiply fifteen minutes by 63 to the power of the number of letters in your password minus 5. And that's if I know your username beforehand. If I don't, multiply the value you got earlier by 63 to the power of the number of letters in your username. Pretty big, huh? :D
Actually, to be honest, I stand a greater chance of crashing your server due to full log file than I do of cracking your password. The effect is generally the same.
On a side note:
My userpics are in PNG format. If you have a compatible browser, you will be able to see through them and notice the alpha. If you have IE 5 or 6, you will see them as though they were always on a grey background.