Saw this on Reddit, figured it would be a good share here too. Maybe @jimmy-t ​ can include it in the next SOC On a related note, I keep finding OMFG’s!!! left behind by the former Network Admin…such as no account lockout threshold being set. More on community.spiceworks.com

12 RTX 5090s to crack my password for an iTunes account from 10 years ago? Be my guest. More on reddit.com

I was wondering whether there is a definitive/standard way to estimate password cracking times and if so, how is it calculated. ... Can you please state your source so we can argue better? Password cracking has been there since, well... More on stackoverflow.com

Edit: Here's one with the authorship more discrete. Sorry, I had no idea this post would get so many views! Probably some of you might like this version to show to your boss or something. In case you're wondering how many attempts per second an attacker would realistically have, a PC with a few thousand dollars worth of graphics cards can brute-force hundreds of billions of password possibilities per second, as this 2012 Arstechnica article reveals. God knows what sort of power an entire nation state's intelligence agency could muster. My chart goes up to 100 trillion. Anyway, this is my first real attempt at data visualization, so I apologize if I've committed any cardinal sins. Constructive criticism is certainly welcome! EDIT: Forgot to mention, the passphrase entropy in my chart was based on the popular Diceware system. But passphrases more generally still operate with the same mathematical formula of entropy = log2(SL ), but S will be the size of the dictionary from which your passphrase is derived (Diceware uses a dictionary of 7776 words, for example) instead of being the number of characters. But it's worth noting that the length (in words) used in the passphrase is usually mathematically far more pertinent than the precise size of the word dictionary. For example, a 5-word Diceware passphrase has an entropy of about 64: log2(77765 ) but a 4-word passphrase from a much larger dictionary of 100,000 words has only 2 more entropy than that: log2(1000004 ) It's also important to emphasize that this entire chart is only applicable if the characters (or words, in the case of passphrases) are chosen at random. For example, the 20 character password peanutbutterandjelly does not have the same entropy as a password made up of 20 randomly chosen lowercase characters. 20 random lowercase characters have an entropy of 94, but if peanutbutterandjelly was chosen as a passphrase from Diceware, it would have 60 entropy. The letters contained in written English are not random; there are patterns and mathematical shortcuts that can be taken to dramatically reduce the entropy of written English compared to a random series of letters of the same length. More on reddit.com