Re:A mode for password hashing
by peterwwillis on Tuesday November 18, 2014 @03:39PM
(#8626188)
Your comparison is invalid because with 'worst hashing' a strong password is still cracked; there's simply too many workable attacks, the algorithm is too fast, and FPGA implementations are trivial.
A password function is the last line of defense, and never foolproof. Looking at the history of successful password exfiltrations over time, attackers have about a month or two before somebody notices they got away with your data. So your password functions should ensure that passwords are strong enough that with current-day technology they can withstand at least that much time out in the wild; otherwise, don't even use a hash.
A password function is the last line of defense, and never foolproof. Looking at the history of successful password exfiltrations over time, attackers have about a month or two before somebody notices they got away with your data. So your password functions should ensure that passwords are strong enough that with current-day technology they can withstand at least that much time out in the wild; otherwise, don't even use a hash.