[aidenn0]

My solution so far is:

  cat /dev/urandom|base64|tr -d '/+'|head -c10

Nearly every site supports a-z,A-Z,0-9 at 10 characters

[jstalin]

10-character apha-numeric password is crackable in a matter of days: http://whitepixel.zorinaq.com/

[elithrar]

> 10-character apha-numeric password is crackable in a matter of days: http://whitepixel.zorinaq.com/

I think the assumption here is that the password isn't an MD5 hash, but instead something a little more resilient. If it's MD5, you're probably screwed anyway.

[Game_Ender]

Does that break more then md5? I thought it was well known that md5 was a bad password hash algorithm.

[jstalin]

I don't know why an application couldn't also attack other hashing algorithms. It's just about brute force creating lots of hashes.

This app also uses GPUs to brute force TrueCrypt: http://www.golubev.com/igprs/

[Johngibb]

Because algorithms like bcrypt have a computational difficulty parameter. You can dial it up so that every check takes something ridiculous. Now instead of brute forcing all of those possibilities in 10 days, it's 1000 centuries.

[bluecalm]

Hash functions are designed to be fast, to use them in stuff like hash tables, hash structures, checksums etc when the faster the function the better (as long as it doesn't have too many collisions). If you transfer data fast and need a lot of checksums or if you do operations on hash structures your goal is speed. On the other hand with passwords you don't want hash, you want encryption and preferably encryption which is very difficult to calculate as encrypting passwords is rare operation and could take those extra CPU cycles for normal use but which is crucial to make it difficult to crack by brute force.

See: http://en.wikipedia.org/wiki/Cryptographic_hash_function

Using hash instead of encryption for passwords is major security mistake

[skeletonjelly]

Have you used pwgen before?

[vacri]

apg is another good one, and if you call it with no arguments, it defaults to 'complex passwords with memorable syllables' (eg "zuWeebsIbep3 (zu-Weebs-Ib-ep-THREE)").