But to give some substance to the claim, the speed record for single-system password hashing in 2012 was ~350GH/s [0].
Let's assume that in 2015 a single system is capable of doing 1TH/s, or ~1000GH/s. So, 10^12 password attempts per second. An attacker, who is not a nation state, should be expected to have access to maybe 400 such systems. But to make this conservative, let's assume they have 1000 such systems. So, the attackers should be able to reach 1000 TH/s, or 10^15 attempts per second.
10^15 =~ 2^(15/0.301) =~ 2^50.
Hence, a determined attacker with finite resources has to do, on average, 2^31 seconds of work to brute force a password with 72 bits of entropy. 2^31 seconds is roughly 68 years.
That in turn means that there are lot of lower hanging fruit to pick before even thinking of expending resources to brute force passwords with 72 bits of entropy.
On the other hand, the resource requirements are getting awfully close to the realm of feasibility, so 72 bits might not be sufficient for long after all...
I feel like it wouldn't be anywhere close to 10^15 if they use a slow hashing algorithm, which is what password stores should be using (e.g. http://en.wikipedia.org/wiki/PBKDF2 )
Every new sensible implementation of password store is using either bcrypt, pbkdf2 or scrypt.
I picked the lowest common denominator because it caters for the worst case scenario. Systems where passwords are improperly hashed are quite likely to have other security problems too. And as such are more likely to get breached, whereby their password store is lifted too.
Bah, that's embarrassing. I will break the HN etiquette and reply to myself, because I will not succumb to editing the post above and retroactively fix a calculation error. Whatever comes from that, I deserve it.
I was off by 2^10. For some reason I kept thinking the 72 bits as 82 bits. You can even see that from the numbers!
So yes, 72 bits is not enough anymore. I stand corrected. New ballpark figure for sensible security margin should be 96 bits.
But to give some substance to the claim, the speed record for single-system password hashing in 2012 was ~350GH/s [0].
Let's assume that in 2015 a single system is capable of doing 1TH/s, or ~1000GH/s. So, 10^12 password attempts per second. An attacker, who is not a nation state, should be expected to have access to maybe 400 such systems. But to make this conservative, let's assume they have 1000 such systems. So, the attackers should be able to reach 1000 TH/s, or 10^15 attempts per second.
10^15 =~ 2^(15/0.301) =~ 2^50.
Hence, a determined attacker with finite resources has to do, on average, 2^31 seconds of work to brute force a password with 72 bits of entropy. 2^31 seconds is roughly 68 years.
That in turn means that there are lot of lower hanging fruit to pick before even thinking of expending resources to brute force passwords with 72 bits of entropy.
On the other hand, the resource requirements are getting awfully close to the realm of feasibility, so 72 bits might not be sufficient for long after all...
0: http://hackaday.com/2012/12/06/25-gpus-brute-force-348-billi...