I have a silly question about PAKE protocols often lauded here.
Magic wormhole uses SPAKE2 algorithm. The passphrase has 16 bits entropy, from which a secure key is derived. The file is available for download for 24 hours in the relay server.
Cannot attacker guess that weak password in 24 hours?
Cannot the relay server store the encrypted files beyond 24 hours and brute force them offline?
I’m sure I’m missing something here.