Hacker News Reader

> a single consumer GPU can test about 2^48 - 2^52 hashes per day

Surely that depends on the hashing function. Moreover, these passwords are usually used for authentication rather than encryption, making the speed of the GPU irrelevant.

Even for encryption, you should probably store a strong key on a hardware TPM and only using the weaker key to authenticate towards the TPM.

View on HN

It matters for authentication. Databases are regularly leaked with password hashes in them.

You can use a bad password if the hash is good enough, or if you assume the hash can never be leaked. But you can't usually assume the hash will be good. It's safer to store a high quality password than to memorize a low quality password.

Reply on news.ycombinator.com