Re:We didn't encrypt your password, we hashed it
by a1369209993 on Friday September 04, 2020 @08:13PM
(#24380256)
You aren't technically wrong (the algorithm can add some number of bits of effective security), but that's still horribly misleading. "P@ssw0rd" is emphatically not a good password, and "because it has lowercase, uppercase, numeric and non-alphanumeric values" does not (significantly) improve a password. See https://www.explainxkcd.com/wiki/index.php/936 for a specific example. (But note that you need eight or more words if the attacker has password hashes that they can attack offline.) Salting adds 0-2 words worth of security depending on how many users can (no longer) be attacked with each hash invocation and a good (slow and optimization-resistant) algorithm adds 1-2 words depending on how slow you're willing to make login.
Edit: I think TFA might be being facitious in the claim "This is a good password because it has lowercase, uppercase, numeric and non-alphanumeric values plus is 8 characters long.", although it doesn't communicate that very clearly.
Edit: I think TFA might be being facitious in the claim "This is a good password because it has lowercase, uppercase, numeric and non-alphanumeric values plus is 8 characters long.", although it doesn't communicate that very clearly.