Hacker News new | past | comments | ask | show | jobs | submit login

If you're a provider of some sort and storing passwords with MD5, shame on you. Or rc4. I'm looking at you, NTLM.

If you're a user and you don't assume that some providers are using MD5... That's just excessively risky.

It's not hard to manage passwords that can't be cracked regardless of the hashing algorithm.




What should I be doing to make a password that can't be cracked regardless of the hashing algorithm?


start using very high entropy passwords which contain just about all printable ascii characters, excluding whitespace.

If a computer cant guess it, it won't crack the hash, either.

Use a password manager and make those suckers 20-40 characters.

Use a master key that is just a super long phrase interleaved with special characters. Easy to remember. Like titles of books you like, plus authors, plus something only you know. Stuff like that.

I use a version of KeePass, with the actual file synced via syncthing to all devices plus a cloud.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: