3 ms·
From the comic: > (Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.
by littlestymaar 2y ago
From the comic:
> (Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.)
And he's right (if you don't trust the website to hash the password securely, then you should assume your password is stored in plain text anyway)
- nullc 2y agoI do credit the comic with being consistent with its own security model-- but attackers having stolen a password database is extremely common (was then too)... and the stakes that users face has also involved in the time since the comic was written. E.g. I've seen people get burned using the comics advice for "brainwallets", which is equivalent to having a published unsalted hash. It's okay to have a confined security model, so long as you understand that's what you're doing. But users usually lack any real ability to gauge how likely password hashes are to leak just due to lack of information on how the sites operate. I think a better justification of the comic's original security level is that it's sufficient for protecting things where a compromise is only a nuisance, as is usually the case for 'random website'. But that isn't true for all password choices people make.