An aspect of security has bugged me for a long time: Why is there positive certainty about the importance of hashing algorithms and salts, but password strength is either never mentioned at all or considered a rather "philosophical" matter?
To me, there are three components of a correct hash implementation:
- Slow and collision-free algorithm.
- Good random salt.
- Strong, dictionary-attack-proof password.
A failure in any component will render the whole hash thing useless. So, to me, there is no point to make a scene about using MD5, but then allow them to use 12345 as a password. To me, password strength is inseparable and strictly a technical matter, of no less importance than the other two aspects.
Yet, when it comes to the simple particular question, there is no particular answer at all!
Want a hashing algorithm suggestion? At your service!
Want to know how to get a good salt? There are a thousand ways!
Want to know what should be the minimum acceptable password strength? Err... you know, there is a trade-off and some political affairs of the sort, so "use the best you can".
But is there a technical, practical definition for the "use the best you can" technology? Just like one about hashing algorithms?
Or, in other words, why there is always a recommendation for the hashing algorithm, and a certain one ("use this"), but there is never a recommendation for the password strength ("allow at least such strength or understand the risk")? Or always an enormous emphasis on the algorithm that should be used and no concern for the strength of the password at all. Can't this leave an impression that the hashing algorithm alone is enough, leaving the poor programmer with a false feeling of security?