6 ms·
The Usability of Passwords
- swGooF 16y agoNice writeup. I used to call passwords with multiple words a "pass-phrase."
- pwg 16y agoYou can also try Password Gorilla ( https://github.com/zdia/gorilla/wiki https://github.com/zdia/gorilla/wiki ) to create, store, manage, and make use of all your passwords.
- 16s 16y agoOff-line attacks (when the password database has been dumped) are much faster than on-line attacks (depending on how the passwords are stored). For example, unsalted, non-iterated md5 hashed passwords can be tested at a rate of 600 million guesses a second on a modern video card with the right software.
- bluesmoon 16y agoOff-line attacks typically target the entire password file rather than a single password in the file. It goes without saying that only hashes should be stored in the file. Simple hashes are still susceptible to rainbow table attacks, so one should use a different random salt for each password. Algorithms like MD5 and SHA1 are also kind of weak with today's computing power, so something like SHA256 should be used. A hash that requires repeated application of the algorithm is also useful since it requires more CPU power to generate.