Timeline for Security of a Random Password
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 17, 2017 at 13:14 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| Sep 18, 2014 at 7:39 | comment | added | BadSkillz | @PwdRsch You are right, I changed it to rainbow tables as they are more probable. | |
| Sep 18, 2014 at 7:37 | history | edited | BadSkillz | CC BY-SA 3.0 |
Removed comment about hash collision
|
| Sep 17, 2014 at 14:39 | comment | added | PwdRsch | @BadSkillz Please don't spread misinformation about collisions being a risk in normal password hashing situations. This type of collisions are simply not a threat with modern hashes unless the system is truncating the password hash or doing something else completely nonstandard. It is improbable for the hash of a 15 character randomly generated password to have a shorter, more easily guessed collision. Yes, there can be collisions in some other specific hash applications but they don't carry over to passwords. | |
| S Sep 17, 2014 at 13:01 | history | suggested | user13695 | CC BY-SA 3.0 |
threads -> threats
|
| Sep 17, 2014 at 12:58 | review | Suggested edits | |||
| S Sep 17, 2014 at 13:01 | |||||
| Sep 17, 2014 at 11:44 | comment | added | Curious | @raj password length is relevant if the password is random. 15 len random password provide log(94^15) > 15*6=90 bits of entropy. Why does it require the salt to give extra security? Any way my question is that if the user set long random password which is protected using salted hash on the server, in case of the database breach, should the user be advised to change his password or not? | |
| Sep 17, 2014 at 11:35 | comment | added | RoraΖ | You should always worry about if your password is salted or not. The password length is irrelevant. This answer is pretty comprehensive, security.stackexchange.com/a/31846/52676 | |
| Sep 17, 2014 at 11:33 | comment | added | BadSkillz | Yes, as I said, without a salt they don't need your exact password, just some string that generates the same hash in the end. You could have a 100 len password, but if 'abcdef' generates the same hash, thats all they need. | |
| Sep 17, 2014 at 11:27 | comment | added | Curious | if I create 15 len random password, do I have to worry whether my password was salted or not? I understand that passwords must be hashed. But if the database breach news reaches me, can't I just relax and not change my password, as it was hashed and my password was random and sufficient long. The brute force search seems to be the only way to break it, but for longer random passwords it is infeasible to do the brute force in a short time. | |
| Sep 17, 2014 at 11:15 | history | answered | BadSkillz | CC BY-SA 3.0 |