3 ms·
You're likely under-estimating the amount of CPU time they're willing to throw at the problem. If you have to ask, the answer is "not strong enough for your pa
by KMag 10y ago
You're likely under-estimating the amount of CPU time they're willing to throw at the problem. If you have to ask, the answer is "not strong enough for your password. Change your Yahoo password. Change all other passwords that were shared. Stop sharing passwords across sites."
On the other hand, my LinkedIn password was 15 base-64 characters, poorly hashed with just SHA-1. As a rough ballpark, cracking it on average comes out to about 500 times all of the work that has ever been put into BitCoin mining. I still changed my password after the breach. Why not?
- Fej 10y agoSo salted bcrypt isn't relatively safe?
- KMag 10y agoIt's safer than, say, unsalted MD4 (NTLM). However, the specifics of the hash only make a difference if your password is weak. As long as the hash is non-invertible, use passwords containing at least 96 bits of entropy, and you're fine. I use https://github.com/kmag/store_password_gpg https://github.com/kmag/store_password_gpg , which is a 200-line Python script I wrote a while ago to generate a random password and encrypt it using gpg. Any decent password manager should allow you to generate unique, random, per-site passwords.