hashcatbenchmark

Those are desktop GPUs though, with (I'm guessing) an order of magnitude more power to deal with. Looking at someone testing laptop GPUs specifically (https://github.com/analsec/hashcatbenchmark), it looks like it's only 3-4x slower than a mobile GTX 1060? And .. also hugely outclassed by even a laptop GTX 1070. Oh well. I'm still holding to "it's impressive for the size and TDP", even if it's probably not enough to replace "SSH into the workstation at the office to run hashcat" yet.

It took way too long on my laptop (i5-6200U). With a decent random password (say, 14 letters), the search space will be very large. If a determined attacker (with a couple of GPUs) can attempt 100.000 passwords per second it will still be impossible to crack in an acceptable time. If we assume that this determined attacker is calculating these hashes 100.000 faster than the average browser, it should be enough if the user has to wait for one second, not one minute. On the other hand everyone has different security requirements so perhaps making it configurable is the best way to go proceed (with some recommendations). PS according to https://github.com/analsec/hashcatbenchmark/blob/master/Nvid... a RTX 2080Ti can crack 750k WPA-EAPOL-PBKDF2 with 4096 rounds per second.