Some kind-heart hacker just sql-injected our website, getting the hash of admin password of 10 lower case chars. It took him half a day to crack it without knowing the SALT (he know that we use "sha256" because the site is opensource).
Now, the manager is not happy. Obviously we will have to change the algorithm to something unpredictable, and a strong admin password, apart from patching that sql-inject hole.
Points to consider:
Password are strong like : "MyB0y6thJan@)!%" : my boy 6th Jan 2015 -> easier to remember. Or passphrase "we love this website so much"
The hackers are usually pro ones, they attacked us all the time. They may have access to 10-100 strong computer.
Hackers may think we are using sha256 as in the opensource but we will change them to something strong like bcrypt.
we would change password every month.
Question: if they manage to sql inject and get the hash in the future, would he be able to crack it fast?
P/S : I have read many similar topic like :
Estimate the time to crack passwords using bcrypt.
How do we estimate the time taken to crack a hash using brute force techniques
But still I am so confused now, many people ( including the hacker) claim that any hash password can be cracked to its original form, just a matter of time. While many say it may take years to crack just one.