Ars was briefly hacked yesterday; here’s what we know

Readers, please change your passwords.

Read the whole story

 

[taiganaut]

ChrisSD[/url]":3v55d5lf]

Threz_[/url]":3v55d5lf]It's unfortunately that Ars is tied down with phpBB's decision to only offer MD5 in the name of compatibility.

Well technically they can replace the phpbb password routine with their own, custom, routine but that is a bit of work to create and maintain.

A patch that calls PBKDF2 or bcrypt, run every time the underlying phpBB *hrk* is upgraded?

 

[taiganaut]

godel[/url]":v9zc0qsf]The borderline for PRACTICAL safety is probably about 10 random characters, unless you're trying to keep the government out, so the twenty characters he's using are plenty.

No, the bare minimum now is about 12 characters, and 15 to be safe.

"In 2010, the Georgia Tech Research Institute developed a method of using GPGPU to crack passwords, coming up with a minimum secure password length of 12 characters.[12][13][14]"