3 ms·

Given today's cloud hardware availability the leaking of the hash of an 8 character password is only good for a few days. The current reasonable minimum is 12 c

• bloopernova 5y ago
  I really wish there was a good standard for password length requirements for websites. Far too many sites out there reject longer passwords, or have a strange dislike of a single special character (which of course differs between sites) Let me use 64 character passwords, dammit!
  • TheGoddessInari 5y ago
    I keep wishing everywhere would allow a length of 256,and the extended ascii set. I know it's overkill, but it makes no practical sense to restrict passwords to a particularly low length, let alone the trend of excluding all but a few special characters. You'd think this is truly the one thing the industry could agree on, but instead you have sites that restrict you to 12 characters, alphanumeric only.
    • LinuxBender 5y ago
      The reason given is usually Denial of Service. The longer passwords create more CPU work on the server multiplied by the number of users logging in or registering accounts. I do not care for that argument. I would much prefer working around potential ddos with proper code segmentation and capacity planning. If it's really an issue then a auth micro-service that predicatively spins up instances or something like that.
• _wldu 5y ago
  bcrypt, scrypt, argon2 or any other reasonably strong password hash will not be cracked in a few days (unless the passwords are simple dictionary words).