4 ms·
This is not good protection against a targeted effort -- when somebody wants to get your account as opposed to any account, when they have one instance of a "sa
by morsch 14y ago
This is not good protection against a targeted effort -- when somebody wants to get your account as opposed to any account, when they have one instance of a "salted" password they might be able to reverse-engineer your salting effort and apply it to another site. And they don't have to completely reverse it, either, it might be enough to significantly reduce the difficulty of brute force.
But it sure beats using an identical password everywhere, and it does have the one major (and massive) advantage of using an identical password on n sites: you only have to remember O(1) things as opposed to O(n). And it can still be done completely in your head, as opposed to other schemes ("real" hashing schemes, password managers) which may introduce their own invulnerabilities or will lock you out from accounts on other computers.
- stcredzero 14y ago...it can still be done completely in your head, as opposed to other schemes ("real" hashing schemes, password managers) I'm using a free password manager (KeePassX) with the file hosted on Dropbox for a couple of years now. I've not had any major trouble with it. People might like to note, though, that my 16 character randomly password (lowercase letters and numbers for over 128 bits of entropy) was still cracked during the LinkedIn incident. I'm switching to 24 character passwords now.
- mistercow 14y agoIsn't that putting a lot of trust into Dropbox, and into your own ability to make sure that you never accidentally leave a computer logged in on Dropbox?
- stcredzero 14y agoThe KeePass file has its own encryption. Just devise one password with enough entropy.
- mistercow 14y agoOh, that makes sense.