Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Looks like they are using zxcvbn[1] to calculate the password entropy and converting it to a time with these parameters:

    computers               speed factor
    ------------------------------------------------
    ZX Spectrum             k: 1300    // 30 guesses per hour (?)
    Mac Book Pro (2012)     k: 1       // 10 guesses per second (?)
    Conficker botnet        k: 5e-5    // 20000 guesses per second (?)
    Tianhe-2 Supercomputer, k: 3e-7    // 3000000 guesses per second (?)
The following line of code suggests that the speed factor is compared to 10 password guesses per second:

    Passwrdr.crack_time = result['crack_times_seconds']['online_no_throttling_10_per_second'];

[1] https://github.com/dropbox/zxcvbn


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: