Security: New VPS Account Info and Emails

[BlueVM]

@willie - Most of the ASICs are only good for generating bitcoin. You literally can't do anything else with them.

I've done some math for everyone's viewing pleasure.

In a given hunt for one 12 character password you might end up going through 2^256 hashes to find the user's password among them:

That's: 115792089237316195423570985008687907853269984665640564039457584007913129639936 hashes

---

Let's say you had 10 FPGA mining modals which could theoretically be converted for your purpose and you were able to store every single hash you generate (something bitcoin mining doesn't do). You would be generating 5,000,000 hashes per second... so at that rate you'd be able to find every password known to man in:

~734348612616160549363083365098223667258181029081941679600821816 years

(Proof: http://www.wolframalpha.com/input/?i=round%5B%28%28%28%28%282%5E256+%2F+5000000%29+%2F+60%29+%2F+60%29+%2F24%29+%2F+365%29%5D)

--

Let's say you magically came across the sum total of all mining hardware in existence and magically converted it for your purpose. Then you'd have 600 Trillion hashes per second (to my knowledge, willing to be proven wrong)... Your hardware would then be able to determine every hash in:

6119571771801337911359028042485197227151508575682847330 years

(Proof: http://www.wolframalpha.com/input/?i=round%5B%28%28%28%28%282%5E256+%2F+600000000000000%29+%2F+60%29+%2F+60%29+%2F24%29+%2F+365%29%5D)

--

So I'd say that our password hashing is safe for a while...

 

[manacit]

I always set my password to something stupid, one time I did "rootpassword" because I was in a hurry. Usually I change the pass and disable pw auth completely after I get my key on there, but this time I forgot.

Two days later it was suspended because it was taking part in Chinese DDoS attacks. OOPS. 

 

[happel]

I would like to note that if you can't trust your email you're screwed any way. Ever thought about the password reset function of the billing/control-panel of your provider? That usually sends you a password reset link/url in plain text! <sarcasm>All providers must turn off password reset functionality!</sarcasm>

 

[tonyg]

I would like to note that if you can't trust your email you're screwed any way.

That's the issue at stake...when email is sent, it travels through unsecure connections (server to server) before it reaches its destination.

So no, email can't be trusted.

 

[dcdan]

That's the issue at stake...when email is sent, it travels through unsecure connections (server to server) before it reaches its destination.

So no, email can't be trusted.

The majority of the e-mail transfers  I see in our logs (server to server) are encrypted.

 

[tonyg]

Thank you BuyVM for no usernames or passwords on the the new VPS email!!!