Hacker News new | past | comments | ask | show | jobs | submit login

Adding four randomly generated characters a-z to your password adds a factor of 456976x to the bruteforce time required.

A password that is derived in 1 millisecond with these characters appended takes longer to crack than a password that is derived in 7 minutes without those characters appended.

"setting the key derivation parameters to take as long as you can tolerate" gives a false sense of security. Because it's taking a minute to log in it must be secure, right? In reality just making your password slightly stronger is far more effective security-wise.




Adding extra random characters to the end of the passphrase requires effort from the user, key derivation only requires them to wait.

Ideally, one should use a strong passphrase with strong key derivation parameters.

You're free to make whatever security trade-offs you like, but don't presume they make sense for everyone.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: