this post was submitted on 26 Sep 2024
548 points (99.3% liked)
Technology
59174 readers
3462 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Cracking an 8-char on an ordinary desktop or laptop PC can still take quite a while depending on the details. Unfortunately, the existence of specialized crypto-coin-mining rigs designed to spit out hashes at high speed, plus the ability to farm things out into the cloud, means that the threat we're facing is no longer the lone hacker cracking things on his own PC.
Newer password hashing algorithms have ways of combatting this. For example, argon2 will use a large amount of memory and CPU and can be tuned for execution time. So theoretically you could configure it to take 0.5 seconds per hash calculation and use 1 GB or more of ram. That's going to be extremely difficult to bruteforce 8 characters.
The trade-off is it will take a second or two to login each time, but if you've got some secondary pin system in place for frequent reauthentication, it can be a pretty good setup.
Another disadvantage is the algorithm effectively gets less secure the less powerful your local device is. Calculating that same 0.5s hash on a beefy server vs your phone could make it take way longer or even impossible without enough ram.
Unfortunately, it's rare that we can control what hashing algorithm is being used to secure the passwords we enter. I merely pray that any account that also holds my credit card data or other important information isn't using MD5. Some companies still don't take cybersecurity seriously.
Storing credit card data has its own set of strict security rules that need to be followed. It's also the credit card company's problem, not yours, as long as you dispute any fraudulent charges early enough.
I'm coming at this from the perspective of a developer. A user can always use a longer password (and you should), but it's technically possible to make an 8 character password secure, thus the NIST recommend minimum.