News for hackers. Stuff that matters.
Re:Top 250 cracked Gawker passwords by qjz on Thursday December 23, 2010 @10:41AM (#2034666)
Truncation to 8 characters is an entropy killer; limiting the range of characters by using the truncated strong hash as the input will reduce it further. In a weak system, you're more likely to find a collision that will effectively substitute for the original password. For two such systems to coexist, you'd need to enforce the use of passwords greater than 8 characters to prevent a crack on the weak system from working on the stronger one.
Re:Top 250 cracked Gawker passwords by JonnieCache on Thursday December 23, 2010 @10:54AM (#2034719)
Thankyou. This is very interesting. Whenever I study cryptography I feel a bit like Alice going down the rabbit hole.

Thank god the safe best-practices are clear and simple in the majority of cases.

EDIT: in case anyone reading this is wondering, the safe best-practice is to USE BCRYPT.

http://codahale.com/how-to-safely-store-a-password/