Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Agreed. But since every character gives you around 6 bits (26*2 letters + 10 numbers + some special characters ≈ 64 = 2^6), you'd need 256/6 ≈ 43 characters to exhaust the checked entropy, so up to that level it makes sense.

If you use sentences instead of randomly generated characters, the entropy (in bits/character) is lower, so 100 characters might well make sense.



Which is why sha+bcrypt is always better than just bcrypt




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: