Hacker News new | ask | show | jobs
by stouset 1618 days ago
There's no KDF in the world that can protect you if your password is in a top-10,000 list or exposed elsewhere alongside your username.
2 comments

Right, but that's sort of what I was getting at. The article doesn't talk much about the password other than it's "insecure". It's probably worth mentioning that a dictionary attack at some multiple of ~2/per-second/per-core is possible. So it's not just top-10,000 list, but maybe "top million" or more that's a bad idea.
Yes, I think that's what the GP was trying to say. The post doesn't qualify "insecure" meaning "not best practices" vs. "insecure" meaning "your password is an extremely common one."