2 ms·
> Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it f
by koolba 5y ago
> Also, if an attacker has a hash of my password the damage is already done anyway. They can do a pass-the-hash attack, they don't even need to brute force it for the plaintext. So there's no real benefit there.
A diceware password of 6 words has an incredible amount of entropy. How would you ever brute force its hash?
> What matters is online guessing and that is severely limited in the amount of attempts.
Belt and suspenders.
- franga2000 5y agoIn pass-the-hash, the password doesn't matter. If you don't know the hash, it's equivalent to online brute-forcing a password of a fixed length, but since that length is usually more than the password itself, it's usually better breaking that. An NTML hash for example has >3× the entropy of a 6-word diceware password, but in an insane situation like 10-word diceware vs md5, brute-forcing the hash would be faster.