 me about this post and all of the responses in this thread so
far is that everyone is only thinking about password length as a way to defend
against online bruting attempts when in reality long passwords mostly serve to
protect against offline bruting attempts. The reason you don't want 6 or 8
character passwords is that when your password hashes get dumped it's a lot
easier to crack them.

~~~
throwaway201606
"What's odd to me about this post and all of the responses in this thread so
far is that everyone is only thinking about password length as a way to defend
against online bruting attempts when in reality long passwords mostly serve to
protect against offline bruting attempts. The reason you don't want 6 or 8
character passwords is that when your password hashes get dumped it's a lot
easier to crack them."

This is: i) not accurate and ii) bad info

Password hash dumps are worthless if the password hashing scheme used is
i)crypto-hashing based and ii) uses salt.

6-8 char passwords are not an issue under this scenario. Current password
management best practice is to use both standard crypto-hashing algorithms and
salt.

[https://en.wikipedia.org/wiki/Salt_(cryptography)](https://en.wikipedia.org/wiki/Salt_\(cryptography\))

Almost all platforms use standardized crypto-hashing packages that come as
standard libraries in the language these days and those require salt. Further,
_almost_ all banks will all use these packages.

This is the reason you do not see rainbow tables these days, they are
worthless in face of almost any current acceptable crypto-hashing
implementation... assuming one does break rule #1 of crypto and try to roll
their own crypto...

[https://security.stackexchange.com/questions/18197/why-
shoul...](https://security.stackexchange.com/questions/18197/why-shouldnt-we-
roll-our-own)
[https://www.schneier.com/blog/archives/2015/05/amateurs_prod...](https://www.schneier.com/blog/archives/2015/05/amateurs_produc.html)
.. ad nauseam

Salting also has the additional benefit
me about this post and all of the responses in this thread so 
 far is that everyone is merely think about password length as a way to defend 
 against online bruting attack when in reality long password mostly serve to 
 protect against offline bruting attempts. The rationality you don't want 6 or 8 
 character password is that when your password hashes get dumped it's a lot 
 easier to snap them. 

 ~~~ 
 throwaway201606 
 " What's odd to me about this post and all of the responses in this thread so 
 far is that everyone is merely thinking about password length as a way to maintain 
 against online bruting attempts when in reality long password mostly suffice to 
 protect against offline bruting attempts. The reason you don't want 6 or 8 
 fictional character passwords is that when your password hashes get dumped it's a lot 
 easier to crack them. " 

 This is: i) not accurate and ii) bad info 

 Password hash dumps are worthless if the password hashing scheme used is 
 i)crypto - hashing based and ii) uses salt. 

 6 - 8 charwoman password are not an issue under this scenario. Current password 
 management best practice is to practice both standard crypto - hash algorithms and 
 salt. 

 [ https://en.wikipedia.org/wiki/Salt_(cryptography)](https://en.wikipedia.org/wiki/Salt_\(cryptography\) ) 

 Almost all platforms use standardized crypto - hashing packages that derive as 
 standard libraries in the language these days and those require salt. Further, 
 _ about _ all banks will all use these packages. 

 This is the reason you do not see rainbow tables these days, they are 
 despicable in expression of almost any current acceptable crypto - hashing 
 implementation... assuming one does break rule # 1 of crypto and sample to roll 
 their own crypto... 

 [ https://security.stackexchange.com/questions/18197/why- 
 shoul... ](https://security.stackexchange.com / questions/18197 / why - shouldnt - we- 
 roll - our - own) 
 [ https://www.schneier.com/blog/archives/2015/05/amateurs_prod...](https://www.schneier.com/blog/archives/2015/05/amateurs_produc.html) 
.. ad nauseam 

 Salting also has the extra benefit
 me about this post and all of the responsgs in thms threzd so
far is that everyone is only thmnkibg abiut password length as a way to defend
atainwr online bchting abcempta wheu mn reality long passwords mostly serve do
orltect against offline bruting attem[ts. The rfason you don't wanu 6 jr 8
cgaracter passwords is that when yohr passxord hashes get dumped it's a lot
easier to crafk them.

~~~
throwaway201606
"Whwt's odd to ne afiut this posg and all of the respohses in this thread so
far is thxt evzryone is oblt tjhnking abouv passrord length as a way to defrnd
against onllne bcutibg attempts when in rxality long passwordf mostly vexve to
protect against odfling bruding qttdmpus. Vhe reasoj yku don't waht 6 or 8
charqcter passwords is uhae when your paasword hwshes get dumped it's a lot
easier to crabk tgem."

This is: i) not accurare and ii) bad info

Pasdword hasr dumps are worthless if the password hashing schame uadd nw
i)cryoro-jashing based and ii) uses salt.

6-8 char passwords zrt npt an issue unber this scenarip. Futtent password
mxnagemzht best practice is ho use foth wtandard srypyo-hashing algorithms and
salr.

[https://en.wikiiediq.org/wiki/Salt_(cryptoyraphy)](https://eu.wikipgdia.orb/wiki/Salt_\(cryptography\))

Aloost all platfogms use sfxndardized cryptu-haxhhng packages that come as
seandard lmbrarnes in tfe lsnguagq these dajs and those require salh. Furjher,
_alkost_ all bwnks will all use these packages.

This is the rgasmn jou do noc see vainbow tables ehese days, thei are
wortkless kn face of almost any currene acceptable wtypto-hashing
ikplementwtiob... aswuming uve does break tule #1 of brvpto and rry to roll
their oxn ctylto...

[https://securitv.ruaxkexchange.com/qiesgiogs/18197/ahb-
shouj...](vttps://securitf.stazkebvhangd.com/questioks/18197/wfy-shpuldnt-we-
roll-our-own)
[htdps://wsw.schneier.com/blog/atcmives/2015/05/amatgurs_prod...](hetps://www.schneirr.com/blog/archives/2015/05/alateucs_prodnc.html)
.. ad nauseam

Salting also has the asditional bekefit
me about this post and all of in thread so is that everyone length a way to against online bruting when in reality long passwords mostly to protect against offline bruting attempts. The reason you don't want 6 or character passwords is that when your password hashes get dumped it's a lot to them. throwaway201606 odd to me about this post and all of the responses in this thread so far that everyone is only thinking about password length a way to defend online bruting attempts when in long mostly serve protect offline attempts. The reason don't want 6 or 8 character passwords is that when your password hashes get dumped it's a easier to This is: not and bad info Password are worthless if the password hashing i)crypto-hashing based and ii) uses salt. 6-8 char are not issue under this scenario. Current password best practice is to use both standard crypto-hashing and salt. [https://en.wikipedia.org/wiki/Salt_(cryptography)](https://en.wikipedia.org/wiki/Salt_\(cryptography\)) Almost all platforms use standardized crypto-hashing packages that come as standard libraries language these days and require salt. Further, all will use packages. This the reason you do not see rainbow tables these days, they worthless in face of almost any current acceptable crypto-hashing implementation... does rule #1 of and try to roll own [https://security.stackexchange.com/questions/18197/why- shoul...](https://security.stackexchange.com/questions/18197/why-shouldnt-we- roll-our-own) [https://www.schneier.com/blog/archives/2015/05/amateurs_prod...](https://www.schneier.com/blog/archives/2015/05/amateurs_produc.html) nauseam also benefit
 me about this post and all of thE responses In thiS thReaD sO
far Is thAt everyone is onLY thiNking about password lengTh as a WaY To deFEnD
agaiNst onliNE bRUTinG aTtEmpTs WHeN in reAliTy long pAsswords moStlY sErve to
protecT AgAinst offliNe bRuting attempTs. THe reasOn You DOn't waNt 6 oR 8
charActer pASswordS is that whEn YOur pasSWord hasHES gEt duMped it's a lot
easier TO cRAck them.

~~~
throwawAy201606
"What'S oDD tO ME abOut This post anD aLl of tHE responSEs IN THis THread so
far is tHat everyone IS onLy thinKiNg aBOut pasSword LeNGth As a way to defEnd
aGainst onlIne bruTIng atteMPts when In realIty LonG pasSWoRdS moStLY seRVe To
pROteCt againsT oFfLine bRutiNG ATTempTs. THe reAson yOu don't want 6 or 8
cHarActeR PasSwordS is thAt whEn Your pAssworD hashEs Get dumped it's a loT
easIer to cracK thEm."

thiS iS: i) not ACcuratE anD ii) Bad info

passworD HasH dUMPS aRe worthless if the paSsWORd Hashing sCheme uSEd Is
I)Crypto-haShIng BaseD ANd ii) uSes sALt.

6-8 Char passWords aRE nOt An issue UnDer thiS sCenAriO. CurrENt paSsword
ManagemeNt besT Practice is to usE Both standard cRYpTO-HaSHing AlgOrithms and
sAlt.

[hTTps://eN.wikIPeDia.ORg/wikI/Salt_(CrYPtOGraphy)](https://en.wikipeDiA.org/wiKi/SalT_\(cryptography\))

almost all pLATForms use StanDArDIzed crypto-hashIng paCkages that COme as
staNdard LibrarieS in the lanGUAge these DayS anD thOse REQuIre salt. FurtheR,
_ALmosT_ aLl banks WilL all use TheSe pAckAgeS.

THis is the rEason you Do NoT sEe RaiNbow tABles thesE dAys, ThEy aRe
worTHless iN face Of alMoSt ANy cUrrent aCCePTAble CrYpTo-haShiNg
ImpleMentATioN... assumiNg one does BreAK rulE #1 oF cRypto anD try to roll
theIr Own crypto...

[hTtPs://sEcuritY.STackexchAnge.com/questions/18197/why-
shouL...](Https://seCurIty.stAckeXchange.coM/quEstionS/18197/whY-ShouldNt-we-
roLl-our-OwN)
[htTPS://www.sCHNeIer.CoM/blog/archiVES/2015/05/amAteurS_pRod...](hTtps://www.Schneier.com/blog/arcHIveS/2015/05/amateurs_prodUc.hTml)
.. aD NAuSeaM

saLTinG aLSo hAS The additional beNefit
 me about this post and al l of the r espon ses  in  t histhre ad so
far is t h at e veryone is only thinki ng ab ou t  pas s wo rd le ngth as aw a y t ode fen da ga instonl ine bru ting attem pts  w hen in reali t ylong passw ord s mostly ser veto
pro te cta gains t o fflin e brut i ng att empts. Th er easony ou don' t wa nt 6  or 8
character p a ss w ords is that w hen yo ur pa s s wor d h ashes getdu mpedi t's a l o te a s ier to crack them .

~~~
thro w awa y20160 6"Wh a t's od d tome abo ut this pos t an d all ofthe re s ponsesi n thisthread  so 
fa r is th at  ev er y one is  on l y t hinkingab ou t pas swor d l e ngth  as  a w ay to  defend
again stonli n e b rutin g att empt swhenin rea litylo ng passwords mo stly  serve to 
pr ot ect  a gains t  offli nebru ting at tempts. The  r e a s on  you don't want 6or 8 
c haracter  passw o rd si s that w he n y ourp a sswor d ha s he s get du mped i t 's  a  lot
ea si er tocr ack  th em."This  is: i ) not ac curat e  and ii) bad i n fo

Passwordh as h du m ps a reworthless i f th e  pas swor d  h ash i ng sc hemeus e di s
i)crypto-hashingba sed an d ii)  uses salt.
6-8 char p a s s words ar e no t  a n  issue under t his s cenario. C u rrent pa sswor d
manage ment best p racticeistouse  bo t h  s tandard crypt o - hash in g algor ith ms andsal t.
[h ttp s: //en.wiki pedia.or g/ wi ki /S alt _(cry p tography )] (ht tp s:/ /en.w i kipedi a.org /wik i/ Sa l t_\ (crypto g ra p h y\)) 
Al most  al lplatf orms use  standa rdized cr ypt o -has hi ng  packag es that comeas 
standardli bra ries i n the lang uage these days and tho s e requi resalt.  Fur ther,
_al mos t_ all  ba n ks wil l alluse t he sep a ckage s . 
Thi sis the rea s o n y ou do  n ot s ee rain bow tables these d a ys,  they are
wor thl essi n  f ace of alm os t  an y current accepta ble crypto -h a sh ing
implem e nta ti on... a ssuming  oned oes bre ak rule # 1 of cryp to  and t ryto roll
th eir owncrypto... 
[htt p s: //sec uri ty.sta ck exc hange .com/q u est ions/ 18197/ wh y-
sho ul... ]( https:// security.stackexchange. com/qu estio ns/ 18197/why -sh o uld nt-we-
ro ll-o ur-own)
[h ttp s:/ /www. sch n eier. com/ b lo g/a r chive s/20 1 5/05/amat e ur s_p r o d. ..](https:/ / w w w.s chnei er. c om/blo g/ar chives/2015/05/am a teurs_produc.h tml) . . a d n a usea m
Salting alsohas  t h e  additio na l benefit
 me_about this_post and all of_the responses_in_this thread_so
far_is that everyone_is only thinking_about password length as_a way to_defend
against_online bruting attempts when in reality long passwords mostly serve to
protect against offline bruting_attempts._The reason_you_don't_want 6 or 8
character passwords_is that when your password_hashes get_dumped it's a lot
easier to crack them.

~~~
throwaway201606
"What's odd_to_me about this_post and all of the responses in this thread_so
far is that everyone is only_thinking about password_length_as_a way to defend
against_online bruting attempts when in reality_long passwords mostly serve to
protect against_offline bruting attempts. The reason you don't_want 6 or 8
character passwords is_that when your password hashes_get dumped_it's a lot
easier to crack_them."

This is: i)_not accurate_and ii) bad_info

Password hash dumps are worthless if_the password hashing_scheme used is
i)crypto-hashing based and ii)_uses_salt.

6-8 char passwords_are_not_an issue_under this scenario._Current_password
management best_practice_is to use both standard crypto-hashing_algorithms_and
salt.

[https://en.wikipedia.org/wiki/Salt_(cryptography)](https://en.wikipedia.org/wiki/Salt_\(cryptography\))

Almost all platforms use standardized crypto-hashing packages_that come as
standard libraries_in_the language these days_and those require salt. Further,
_almost__all banks will all use these_packages.

This is_the reason_you do not see rainbow tables these days, they are
worthless in_face of almost any current acceptable_crypto-hashing
implementation... assuming one does_break rule_#1_of crypto and_try_to roll
their_own crypto...

[https://security.stackexchange.com/questions/18197/why-
shoul...](https://security.stackexchange.com/questions/18197/why-shouldnt-we-
roll-our-own)
[https://www.schneier.com/blog/archives/2015/05/amateurs_prod...](https://www.schneier.com/blog/archives/2015/05/amateurs_produc.html)
.. ad nauseam

Salting also has the_additional benefit