52 ms·

Pretty good calculations of the kind of expected time: http://security.stackexchange.com/questions/12994/whats-the-practical-limit-for-rainbow-table-based-brute

by RyanZAG 14y ago

Pretty good calculations of the kind of expected time: http://security.stackexchange.com/questions/12994/whats-the-practical-limit-for-rainbow-table-based-bruteforce http://security.stackexchange.com/questions/12994/whats-the-... These are with MD5/SHA1 style hashes, which shows that your password is pretty safe regardless of hash method (as long as it has salt) if it has enough entropy in it. Pretty interesting.

thaumaturgy 14y ago
Nice link, thanks for sharing that. So, this also is a slightly different situation. If you are an end-user, yes, you can protect your individual password against stupid hashing schemes by using passwords with lots of entropy. (I use KeePassX for this.) However, if you are a service provider, you have to protect your users from the stupid passwords that around 30% of them are likely to use and re-use elsewhere, and you do that by using a smart hashing scheme (like bcrypt or scrypt) that makes brute-forcing the passwords an annoying and time-consuming endeavor.