3 ms·
Only for weak passwords. Strong (80-bit plus) passwords are still safe, even with unsalted MD5. Too bad people are really bad at choosing passwords.
by svenfaw 10y ago
Only for weak passwords. Strong (80-bit plus) passwords are still safe, even with unsalted MD5. Too bad people are really bad at choosing passwords.
- AdmiralAsshat 10y agoToo bad as well that very, very few sites support 80 character long passwords. Ever since I switched to a password manager, I've always made sure that the length of it is the maximum length that the site will accept. I am getting pretty pissed with the sites that have ridiculous "security" schemes like 1 capital letter, 1 one number, 1 special character, must rotate every three months...but will only allow a password between 8-12 characters long.
- jgalt212 10y agowait, which one is strong enough under MD5 hashing? 80 bit or 80 character?
- wolf550e 10y ago80 bits of entropy (20 really random hex chars) should be safe enough.
- deleted 10y ago[deleted]
- lmm 10y agoMD5 caps your overall complexity at 128 bits (realistically probably 110 bits with modern attacks). Typical english text has about 3 bits/character, completely random ascii is 7 bits/character (though that includes control codes you probably can't put in a password field). So 80 characters of typical English would be ~240 bits (obviously 80 characters of just 'aaa...' would be less), so definitely overkill for MD5; ~36 characters (110/3) is the point where you max out what you can do with MD5, and ~26 characters (80/3) is good enough. You can reduce these numbers a bit by using upper case, symbols etc., but personally I find it easier to remember 26 characters of normal English than 13 characters of random letters and symbols.
- Shivatron 10y agoGrandparent was suggesting that 80-bit, not 80-character, passwords were sufficient -- though I agree as a rule that more characters is generally better.