Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://infosec.exchange/users/tychotithonus/statuses/113992002558323979">Royce Williams (tychotithonus@infosec.exchange)'s status on Thursday, 13-Feb-2025 02:05:24 JST</a><a href="https://infosec.exchange/@tychotithonus" title="tychotithonus@infosec.exchange"><img src="https://gnusocial.jp/avatar/92920-48-20240902162501.webp" width="48" height="48" alt="Royce Williams" style="position: absolute; left: 0; top: 0;">Royce Williams</a><div><a href="https://infosec.exchange/@ryanc/113990011951275800" rel="in-reply-to">in reply to</a><ul><li><li><a href="https://gnusocial.jp/user/327665" title="chick3nman@infosec.exchange">Chick3nman</a></li></ul></div></section><article><p><a href="https://infosec.exchange/@ryanc">@ryanc</a></p><p>Hmm! I haven't spent much time attacking yescrypt yet, but since it's based on scrypt, it has other parameters to tweak.</p><p>It looks like the spec minimum of 5 for n is implemented for common OS-level implementations?</p><p><a href="https://www.reddit.com/r/Passwords/comments/1cd58c3/" rel="nofollow">https://www.reddit.com/r/Passwords/comments/1cd58c3/</a></p><p>I do not know if the r parameter can be reduced in the defaults (login.defs or whatever the equivalent is on your OS). If you can reduce r, you can drop speed further. In theory, you might be able to use mkpasswd to drop r manually and then paste that hash in?</p><p>How many milliseconds is it taking for you on that platform?</p><p><a href="https://infosec.exchange/@chick3nman">@chick3nman</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/4551440#notice-8914807">In conversation</a><time datetime="2025-02-13T02:05:24+09:00" title="Thursday, 13-Feb-2025 02:05:24 JST">about 4 months ago</time> <span>from <span><a href="https://infosec.exchange/@tychotithonus/113992002558323979" rel="external" title="Sent from infosec.exchange via ActivityPub">infosec.exchange</a></span></span><a href="https://infosec.exchange/@tychotithonus/113992002558323979">permalink</a><h4>Attachments</h4><ol><li><article><header><div>No result found on File_thumbnail lookup.</div><h5><a href="http://tweak.It/">tweak.it</a></h5><div></div></header><div></div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Royce Williams (tychotithonus@infosec.exchange)'s status on Thursday, 13-Feb-2025 02:05:24 JSTRoyce Williams
in reply to
- Ryan Castellucci :nonbinary_flag:
- Chick3nman
@ryanc
Hmm! I haven't spent much time attacking yescrypt yet, but since it's based on scrypt, it has other parameters to tweak.
It looks like the spec minimum of 5 for n is implemented for common OS-level implementations?
https://www.reddit.com/r/Passwords/comments/1cd58c3/
I do not know if the r parameter can be reduced in the defaults (login.defs or whatever the equivalent is on your OS). If you can reduce r, you can drop speed further. In theory, you might be able to use mkpasswd to drop r manually and then paste that hash in?
How many milliseconds is it taking for you on that platform?
@chick3nman
In conversationabout 4 months ago from infosec.exchangepermalink
Attachments
1. No result found on File_thumbnail lookup.
  tweak.it

Public

Embed Notice

HTML Code

Corresponding Notice