Even if they have a passphrase it has to be strong enough to withstand brute for... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

seabee on April 16, 2013 | parent | context | favorite | on: Security incident update

Even if they have a passphrase it has to be strong enough to withstand brute force for months. If you're not smart enough to keep the private key separate from the crap you're trying to protect, why should I think you're smart enough to ensure your passphrase is good enough?

jrockway on April 16, 2013 [–]

why should I think you're smart enough to ensure your passphrase is good enough

Key strengthening.

ryan-c on April 16, 2013 | [–]

OpenSSL doesn't use key strengthening on password protected RSA keys. GPG does, but I don't know how much it does by default.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact