CloudCracker Blog

There are already services that do this https://cloudcracker.com/ (wpa not scrypt but hopefully you see my point)

The code is never trasnmitted. The data is encrypted with the code and only the code on the other side can be used to decrypt it. Most brute-force systems work by capturing packets to hard drive and then attempting to decrypt them offline. Or you can upload your captures to the cloud: https://www.cloudcracker.com/

Even those who don't have such rigs can just rent them from, for example, Moxie Marlinspike's Cloud Cracker: https://www.cloudcracker.com/

I want my time back, three pages on basically nothing. I broke into my house last year because I lost my keys -> brb writing an article titled "How I became a burglar and locksmith"* *I took my keys from in the house so... by ars standard that's serious theft. Rather than reading that article might I suggest having a gander at moxie's https://www.cloudcracker.com and read his blog too for all the goodies.

To crack a brainwallet, given only the public key and sufficient bits in the password, is actually harder than directly attacking the private key. It's incredible to see such misinformation on HN. I suggest you read this: https://dl.dropboxusercontent.com/u/315/articles/A%20Large-Scale%20Stu… This is a 2007 study on web password habits. In it, they reveal the fact that fewer than 1% of passwords have bitstrength >= 90 bits: http://i.imgur.com/8vSrx2E.png Achieving 128 bits of protection with a user selectable and memorable password is statistically unlikely (to put it mildly). The fact that a brainwallet password is memorable means a computer can bruteforce it in far fewer operations, too. I.e. the bitstrength is mostly meaningless. Just ask the guy who runs http://www.cloudcracker.com A memorable user-selectable password is incredibly unlikely to be as strong as 128 random bits.

To reinforce your point, DES is now crackable by the public in under a day: https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/

Something like this: https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/

Cloudcrack has a 40-core FPGA solution that allegedly can break MS-CHAPv2 in a day[1]. Looks like they charge $100/lookup[2]. -- [1] https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/ [2] https://www.cloudcracker.com/dictionaries.html (in the mouseover text in the graph for brute-forcing DES keys).

I hope you're aware that pptp connections (including via poptop) can be broken easily. https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/

Yep, in public compromises of large sets of WPA passphrases, more than 50% of them are phone numbers. This is why we offer a CloudCracker dictionary which includes every valid NANP number in it: https://www.cloudcracker.com/dictionaries.html

Here's Moxie Marlinspike's blog post about the MS-CHAPv2 vulnerabilities: https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/ Bruce Schneier also wrote about MS-CHAPv2 vulnerabilities back in 1999: https://www.schneier.com/paper-pptpv2.html

The big sticker in the top right hand corner of the main page (https://www.cloudcracker.com/css/images/sticker3.png).

Ah, so don't use any of the 300,000,000 words in their dictionary - https://www.cloudcracker.com/dictionaries.html Any simple password generator (say, Apple's Keychain, or pwgen) should be able to generate a non-dictionary key of length 12-16 characters in a few seconds that would withstand this and most similar techniques for the next few years.