Post #3870462
2026-07-16 16:46 UTC
In my not-so-humble opinion, their password table comes with the baggage of using specific hardware and assumes a specific hash type with cost.
A better table shows what the raw symmetric bits actually look like. Then it doesn't matter if it's hashed with vanilla MD5 or bcrypt 10. It doesn't matter if it's a single RTX 5090 or a distributed compute cluster.
We know what current brute force rates look like, so the colors in my table follow directly from those results.
https://gist.github.com/atoponce/a7715930ae6eb7d6b487f2f76b57a68d
Replies (2)
-
@atoponce@fosstodon.org 2026-07-16 16:48
I should build a similar table for passphrases. Because the XKCD "correct horse battery staple" approach that is commonly cited everywhere is flawed, and I get tired of explaining it in detail every time I call it out.
-
@davep@infosec.exchange 2026-07-16 17:24
@atoponce@fosstodon.org The table I purloined over a decade ago still seems a good tech-agnostic view. https://penfold.fr/img/entropy.png