As I said later in the comment: if someone gets read-only access to the database. Certainly you won’t be able to guess that quickly through Fossil’s web interfa

As I said later in the comment: if someone gets read-only access to the database. Certainly you won’t be able to guess that quickly through Fossil’s web interface. If you could, this would be a catastrophe. As it is, it’s only very bad. These sorts of things are all about defence in depth. Some have said: “What’s wrong with storing passwords in cleartext? No one else can access them anyway!” But then a bug in another part of your system allows exfiltration of the database. It’s that kind of thing. Weak password storage is also as much a problem for other systems as it is for one’s own system, due to password reuse. I gather from a little more research that current CPUs can probably do over ten million SHA-1 hashes per second (some extrapolation of old figures there), and consumer-grade GPUs over twenty trillion. This will crack even moderately strong passwords in a very short time. For comparison, Argon2 is designed as a proper password hash (resistant against acceleration) and its recommendation is to make passwords take a few hundred milliseconds to check (increasing the number of iterations as hardware gets faster). So maybe three per second, which basically renders any cracking whatsoever infeasible.