Mailing List Archive: GnuPG: users

Interesting article on password guessing via cloud computing

Index | Next | Previous | View Threaded

dshaw at jabberwocky

Nov 4, 2009, 10:34 AM

Post #1 of 6 (1036 views)
Permalink

Interesting article on password guessing via cloud computing

http://news.electricalchemy.net/2009/10/cracking-passwords-in-cloud.html

This is not, of course, an OpenPGP "crack", but rather high-speed
password guessing. The nice thing about cloud password guessing is it
enables people to spin up massive cracking farms without actually
having to manage the racks and racks of running hardware.

David

_______________________________________________
Gnupg-users mailing list
Gnupg-users [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-users

josselin.jacquard at gmail

Nov 4, 2009, 12:33 PM

Post #2 of 6 (963 views)
Permalink

Re: Interesting article on password guessing via cloud computing [In reply to]

Yes but you're supposed to pay to use ressource on a cloud system arn't you
? Is it usable computing for free ?

2009/11/4 David Shaw <dshaw [at] jabberwocky>

> http://news.electricalchemy.net/2009/10/cracking-passwords-in-cloud.html
>
> This is not, of course, an OpenPGP "crack", but rather high-speed password
> guessing. The nice thing about cloud password guessing is it enables people
> to spin up massive cracking farms without actually having to manage the
> racks and racks of running hardware.
>
> David
>
>
> _______________________________________________
> Gnupg-users mailing list
> Gnupg-users [at] gnupg
> http://lists.gnupg.org/mailman/listinfo/gnupg-users
>

dshaw at jabberwocky

Nov 4, 2009, 5:03 PM

Post #3 of 6 (966 views)
Permalink

Re: Interesting article on password guessing via cloud computing [In reply to]

On Nov 4, 2009, at 3:33 PM, Josselin Jacquard wrote:

> Yes but you're supposed to pay to use ressource on a cloud system
> arn't you ? Is it usable computing for free ?

Of course not. Where did anyone say it was free?

I said "The nice thing about cloud password guessing is it enables
people to spin up massive cracking farms without actually having to
manage the racks and racks of running hardware." Running hundreds of
machines is difficult and expensive in terms of the physical plant:
lots of racks, lots of cooling, lots of electricity, lots of
management. Amazon does all that for you (and charges you for it, of
course). Given Amazon's size, they can generally do the messy part of
managing hundreds of machines (especially since they are virtual
machines) cheaper than you can.

David

_______________________________________________
Gnupg-users mailing list
Gnupg-users [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-users

vedaal at hush

Nov 5, 2009, 7:05 AM

Post #4 of 6 (951 views)
Permalink

Re: Interesting article on password guessing via cloud computing [In reply to]

David Shaw <dshaw () jabberwocky ! com>
wrote on 2009-11-04 18:34:49 :

>This is not, of course, an OpenPGP "crack", but rather high-speed

>password guessing.

a trivial way to defeat this,
would be to provide each client with a pgp keypair,
(physically presented to the client upon the initial transaction
agreement),
and then encrypt the zipfile to a key and not even use a passphrase

what would be even more interesting,
is if it could be done in a way that truecrypt uses to protect its
encrypted volumes, where the user can choose to use a keyfile as
well as a passphrase, but it cannot be determined before decryption
if a keyfile, passphrase, both or only one, has been used

so, imagine if a client has a zipfile encrypted to both a trivial
password and to a pgp key, and it is not determinable from the
encrypted file itself, if it was encrypted to a key as well,

all the cloud computing resources available will merrily spin
themselves into exhaustion ubtil they decide that the passphrase is
'probably too long and complex to crack'

vedaal

_______________________________________________
Gnupg-users mailing list
Gnupg-users [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-users

rjh at sixdemonbag

Nov 5, 2009, 8:59 AM

Post #5 of 6 (956 views)
Permalink

Re: Interesting article on password guessing via cloud computing [In reply to]

vedaal [at] hush wrote:
> a trivial way to defeat this,

An even more trivial way is to use a strong passphrase. It's generally
wise to use the smallest hammer necessary to drive in the nail.

_______________________________________________
Gnupg-users mailing list
Gnupg-users [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-users

hs2412 at gmail

Nov 14, 2009, 7:02 AM

Post #6 of 6 (821 views)
Permalink

Re: Interesting article on password guessing via cloud computing [In reply to]

Hi David Vedaal and everyone

This is something even I have thought: this seems to be a sure way to
prevent such computing from being able to 'guess' the password. Why is
then, parallel computing being haled as the antidote to privacy?

Regards
Hardeep Singh
http://blog.Hardeep.name
Sent from Delhi, India

On Thu, Nov 5, 2009 at 8:35 PM, <vedaal [at] hush> wrote:
> David Shaw <dshaw () jabberwocky ! com>
> wrote on 2009-11-04 18:34:49 :
>
>>This is not, of course, an OpenPGP "crack", but rather high-speed
>
>>password guessing.
>
> a trivial way to defeat this,
> would be to provide each client with a pgp keypair,
> (physically presented to the client upon the initial transaction
> agreement),
> and then encrypt the zipfile to a key and not even use a passphrase
>
> what would be even more interesting,
> is if it could be done in a way that truecrypt uses to protect its
> encrypted volumes, where the user can choose to use a keyfile as
> well as a passphrase, but it cannot be determined before decryption
> if a keyfile, passphrase, both or only one, �has been used
>
> so, imagine if a client has a zipfile encrypted to both a trivial
> password and to a pgp key, and it is not determinable from the
> encrypted file itself, if it was encrypted to a key as well,
>
> all the cloud computing resources available will merrily spin
> themselves into exhaustion ubtil they decide that the passphrase is
> 'probably too long and complex to crack'
>
>
> vedaal
>
>
> _______________________________________________
> Gnupg-users mailing list
> Gnupg-users [at] gnupg
> http://lists.gnupg.org/mailman/listinfo/gnupg-users
>

_______________________________________________
Gnupg-users mailing list
Gnupg-users [at] gnupg
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads