Because we love you SSL/HTTPS is now enabled
- Thread starter Alpha1
- Start date
BristolMartin
Active member
Alpha1 said:For all forum logins.
On top of this all passwords are hashed and encrypted by default in the database (was from day1, but thought i'd mention it).
We love you guys,
The UKVAC Team
Salted?
BristolMartin said:
Kind-of
No one is going to be able to feed these through any common rainbow table; brute-force hashing would eventually get you somewhere before the heat death of the planet, but it wouldn't be my first avenue of attack.
But nobody is going to be using a frequently-used password on a site run by a bunch of randoms, right? Good!
BristolMartin
Active member
Nice to know. Different password for everything me, although its based around a personal algorithm so I don't forget them.
BristolMartin
Active member
Its actually a difficult decision as an Architect. I dont force strong passwords on any app or site I write or govern because it tempts / forces muggles to put in their strong internet banking passwords, so I normally just say over 6 with no ANOS. Im fairly confident in today's world with a full DB breach they should be safe. Tomorrow is another matter.
Nerd attack (sorry)
Entropy calculations for the unseeded passwords above show:
*I assume it's using the basic ASCII range, not the full range possible on a us-uk keyboard.
Entropy calculations for the unseeded passwords above show:
Code:
Password - Shannon entropy - Shannon entropy/length - entropy over ASCII*
"cabbage" - 0.31942 - 2.23593 - 34.35 bits
"password1" - 0.32752 - 2.9477 - 48.53 bits
my password - 0.30283 - 2.72548 - 54.59 bits*I assume it's using the basic ASCII range, not the full range possible on a us-uk keyboard.