Hacker News new | ask | show | jobs
by NegativeK 751 days ago
If you're a provider of some sort and storing passwords with MD5, shame on you. Or rc4. I'm looking at you, NTLM.

If you're a user and you don't assume that some providers are using MD5... That's just excessively risky.

It's not hard to manage passwords that can't be cracked regardless of the hashing algorithm.

1 comments

What should I be doing to make a password that can't be cracked regardless of the hashing algorithm?
start using very high entropy passwords which contain just about all printable ascii characters, excluding whitespace.

If a computer cant guess it, it won't crack the hash, either.

Use a password manager and make those suckers 20-40 characters.

Use a master key that is just a super long phrase interleaved with special characters. Easy to remember. Like titles of books you like, plus authors, plus something only you know. Stuff like that.

I use a version of KeePass, with the actual file synced via syncthing to all devices plus a cloud.