The takeaway here is that cracking a 64bit password only cost $1700 and is totally doable in 3 weeks.
If you need things to be really safe I guess you need to start lengthening those passwords.
Not quite - you need to run the hash function that the password is stored with, and that might be a factor of 1,000,000+ slowdown relative to "are these numbers the same".
>The takeaway here is that cracking a 64bit password only cost $1700 and is totally doable in 3 weeks.
...assuming that each "guess" only requires a comparison. If you factor in hashing, it's much slower. According to gpuhashcat benchmarks[1], a 1080 ti crack md5 passwords at ~25 GH/s (1GH/s = 1 billion guesses per second), phpass at ~6.9 MH/s, and bcrypt passwords at 13 KH/s.
[1] https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...
Those $1700 of computational costs are likely to be run on hacked infrastructure, so definitely doable.
1.7 billion in computation