05 - Jeff Goldberg - A Report on the 1Password Cracking Challenge
Channel: Per Thorsheim
Date: 23/11/2020

In 2018, 1Password ran a password cracking challenge. The aim was to help us at 1Password better understand how effective our slow hashing of Master Passwords (MPs) is at raising the costs for attackers who might be in a position to crack a MP. We succeeded at this, coming to the conclusion that in late 2018 prices, the cracking costs are approximately 6 USD per 2^32 guesses.

This talk will describe how we arrived at that conclusion, how and why we designed the challenged the way we did, and how and why we had to make several adjustments during the course of the challenge, including quadrupling the prizes and the mechanism of hints.

We also discuss the advantages of trying to measure effectiveness of slow hashing in money terms instead of in time, and the need to consider the attackers’ opportunity costs when assessing risk.

In total, we awarded nearly 32,000 USD in prize money.