Hacker News Reader

It depends on your KDF. MD5 is ridiculously weak; the standard MD5-crypt is 1000 times stronger; bcrypt is better yet; and scrypt is vastly stronger.

The best source for this my scrypt paper, really.

Link: http://www.tarsnap.com/scrypt.html

What license is the scrypt code released under?

It's BSD licensed but probably not easy to integrate on your platform. BCrypt is an easier choice. When we see Java and .NET implementations of scrypt, we'll start recommending it, but I'll be honest and tell you that we rarely recommend scrypt today.

I wish I could find a link but,US military spec for secure passwords is 14 characters with capitals and special chars. And they have to be changed every 30 days.

http://xkcd.com/538/

True enough, if you're targeted it's not going to help very much. However, like outrunning a bear, you only need to be harder to catch than the guy behind you.