>However, despite these advantages in fuel-efficiency and specific impulse, the most sophisticated NTP concept has a maximum specific impulse of 5000 seconds (50 kN·s/kg). Using nuclear engines driven by fission or fusion, NASA scientists estimate it would could take a spaceship only 90 days to get to Mars when the planet was at “opposition” – i.e. as close as 55,000,000 km from Earth.
> But adjusted for a one-way journey to Proxima Centauri, a nuclear rocket would still take centuries to accelerate to the point where it was flying a fraction of the speed of light. It would then require several decades of travel time, followed by many more centuries of deceleration before reaching it destination. All told, were still talking about 1000 years before it reaches its destination. Good for interplanetary missions, not so good for interstellar ones.
There's talk of other drive systems being able to pull it off but this is the only one that actually has been tested but never built to scale.
Keep in mind that at best it would take maybe 1,000 years with current technology to get there with a probe or human-supporting ship. It would be highly unpopular however as it involves exploding nuclear bombs behind the craft to get it there that fast--that and it would probably cost trillions to build the thing.
If the server had bcrypt configured to take a second per password, multiple everything by 4. And so on. What I think is needed as a supplement to "use bcrypt / scrypt" is a "and use it this way so you don't accidentally open your server to DoSing or give a poor experience", because a 10 seconds-to-compute-on-a-Xeon hash is great from a security standpoint if your hashes get leaked, it sucks from a user experience to have to wait at least 10 seconds to login, and if you have to service multiple logins at once your server's not going to be able to do anything else if you just use bcrypt/scrypt synchronously.
If you're in a situation where you're needing to rely on hashing a user's password for every action, your application has far worse problems than what password storage method is in play. Moving from your current password storage method that is inadequate to one that would be better also takes into account that you haven't done something completely wrong with session states.
[edit]
I misread the poster I was responding to assuming that they meant that the user was re-authenticating on each request. My thought process was that if they're storing credentials in a cookie in lieu of a session ID then that needed to be addressed first before even going down the avenue of correcting password storage.
As part of a presentation I did at a local OWASP chapter, here are some numbers based on just using CPython's Hashlib processing of 14,000,000 someodd passwords:
The author of this piece was doing about 156 hashes per second and after just over five days, he had only gone through and cracked 4,000 account passwords--we're talking 0.0001% of Ashley Madison's supposed userbase here. To run just over the 14,000,000 passwords from RockYou.txt on every single user account from AM, it would take up to at least two billion years.
No. You cannot effectively use the techniques you can use against SHA/MD5 to attack the three I mentioned.
SHA and MD5 can be calculated entirely in a CPU's registers without having to rely on RAM. Bcrypt for example requires the use of a matrix as part of its calculation, slowing down the process. A GPU has so few channels from the processor to memory that it cannot be effectively done in parallel.
All one has to do with Bcrypt is just adjust the difficulty and any advances in GPU technology or whatever can be nullified.
Any developer today that is developing an application and isn't using something like Argon2, Bcrypt, or Scrypt should be considering a plan to move away from whatever they're currently using yesterday. There is no reason to be using anything less than those three and continued use is in my mind negligence.
If at all possible you shouldn't be storing passwords to begin with and instead relying on another service for authentication.
> A few people will donate bitcoin. A few things can be bought directly with bitcoin. On average, you'd expect that the fraction of your income paid in bitcoin would be similar to the fraction of goods and services that you can pay for with bitcoin.
The point of donating money to the author of the piece is to encourage them to continue writing this epic story. Giving them Bitcoin is akin to leaving a tip to your server where the tip appears to be currency but rather instead is a Chick tract with the suggestion that you'll pray for their soul.
> As far as unauthorized use of campus resources, I think the university would be better served by suing AT&T for failing to adequately protect its network.
It is not the responsibility of a network service provider to protect the assets of a customer. If you're given a network link and an allocation of IP addresses, it is your responsibility to use them wisely and securely.
> Or maybe universities and organizations could teach their employees to handle network security better.
France and Austria, unlike Canada are very much dense so the infrastructure required to setup an LTE/UMTS/etc network is less costly.
To travel from Vancouver to the next principal Canadian city (Calgary), it requires 900 KM of driving and there's only really one metropolitan area of sorts between the two, meaning that you're going to be setting up cell towers that handle only so much traffic in a day.
As a result, to get service where you end up with just traffic shaping once you go beyond 6 GB (beyond that there is no real limit really), you need to go with a carrier that only services the larger cities. So in my case, my carrier services just Vancouver, Edmonton, Calgary, Toronto, and Ottawa, which are fairly dense areas with a combined population of 18 million or so, or just about half of the country's population. Once I leave the city, I have to piggyback on to other carriers however.
Hence why mobile carriers suck in Canada because the bigger carriers do not want to eat into their fairly large profit margins. They can afford to offer such plans, but they simply don't want to.
For the record, I pay $40 CAD/month ($30 USD or 27 EUR) for unlimited North American calling and text plus the "unlimited" data use.
$399 USD is great, but why are we still stuck with 16 GB of storage on base model phones? You can barely put a day's worth of music on your phone and you cannot always stream via services like Spotify.
Spotify accounts for 2 GB of traffic per month on my phone and some plans are barely affordable when you want more than that--fortunately I can do up to 6 GB before I am traffic shaped, but that isn't the say the same for all carriers in this country.
I believe that the passwords were exposed in the breach but at the moment I don't have them to look at.
Generally I recommend that if you think that your password has been exposed that you just reset your password as if you have to ask that question then you might want to reconsider your password reuse.
This was discussed on HN a while back and comes up quite often:
https://news.ycombinator.com/item?id=10905643