> Whats the security implication of leaking the root hash? That you can try to crack the hash off-line with something like hashcat. For a random, salted, 22 c

> Whats the security implication of leaking the root hash? That you can try to crack the hash off-line with something like hashcat. For a random, salted, 22 character password (roughly log2(62^22)~130 bits of entropy, no rainbow tables because of the salt) - it might not be game over. On the other hand - if you can make an educated guess at the password - it's now trivial to check a few million variations without having to try to log in. As other's mentioned - reading arbitrary memory is probably worse (eg keyboard buffer, getting the plaintext password if a user logs in...).