4 ms·
This sounds a little obsessive. How often are hackers brute forcing a random 16 character hash?
by WhitneyLand 11y ago
This sounds a little obsessive. How often are hackers brute forcing a random 16 character hash?
- dagss 11y agoPoint is you can use passphrases that are easier for humans to remember, but you then need to measure entropy as numbers of words and size of dictionary and 16 characters is too little. https://xkcd.com/936/ https://xkcd.com/936/
- lhecker 11y agoYep exactly that. It would be great if I could just use some whole words as the password for accounts which I need to use often or are really important and thus IMHO make password stores impractical (e.g. desktop login, Gmail, …)
- eru 11y agoAdd second factor authorization for these, in any case. Google Authenticator app on the phone works reasonably well, or perhaps even get a physical token.
- freehunter 11y agoI use a passphrase on my Gmail account in the manner of "This is the password I am using for Gmail". Works just fine.
- WhitneyLand 11y agoPass phrases can be a problem because they are attacked using dictionaries just like words are. Choose carefully.
- amalcon 11y agoOne other issue is that this indicates a site doing something they should not be. The best practice for password storage is to use a secure password hash like bcrypt, and not store the actual password at all. If one actually does this, the length of the password becomes almost irrelevant to the server. You might want to reject 10MB passwords or something, to prevent someone from taking up all your RAM during login, but the difference between 16 characters and 1024 (or 72, the max for bcrypt) is irrelevant.