4 ms·

Passwords are not "security by obscurity".

• guygurari 16y ago
  No. The difference between passwords and this is.
• noahl 16y ago
  The "obscurity" is the idea that an attacker would not know that you were generating your passwords by SHA-1 hashing a passphrase. If the attacker did not know that, they could only brute-force your account by trying every possible string of characters, which is fine, because there are a lot of those. If, however, they knew what you were doing, then they could generate a list of likely-seeming passphrases, hash those, and try those hashes as passwords. If there are fewer likely passphrases than there are strings of characters, this shrinks their search space. Also, once they know you're using passphrases, they might also know that some phrases are much more likely than others, so they could try those first. This would give them a good chance of finding your password even more quickly.