News for hackers. Stuff that matters.

A comment on 49% of workers, forced to change passwords, reuse same one with minor change. Parent comment

Re:49% of workers, forced to change passwords, reuse same on... by mtzet on Saturday December 14, 2019 @02:12AM (#21788255)
> a single consumer GPU can test about 2^48 - 2^52 hashes per day

Surely that depends on the hashing function. Moreover, these passwords are usually used for authentication rather than encryption, making the speed of the GPU irrelevant.

Even for encryption, you should probably store a strong key on a hardware TPM and only using the weaker key to authenticate towards the TPM.

[ Parent | on HN ]
Re:49% of workers, forced to change passwords, reuse same on... by Dylan16807 on Saturday December 14, 2019 @02:23AM (#21788287)
It matters for authentication. Databases are regularly leaked with password hashes in them.

You can use a bad password if the hash is good enough, or if you assume the hash can never be leaked. But you can't usually assume the hash will be good. It's safer to store a high quality password than to memorize a low quality password.

[ Parent | on HN ]