Hacker News Reader

Of course it will, since the password is stored as a string. It may be a random set of 0-9a-f, but a brute force attack will still only need to use those characters. Compare that to a password of the same character length using any possible characters and you can see that it is clearly weaker.

View on HN

You need to re-read Shannon. The information content of a 128 bit random integer encoded in 32 alphanumeric characters is 128 bits. You cannot feasibly brute-force a 128 bit random number: if you could guess 1000 times per second, it would take you 323708492124180425669115874649 years.

[edit: i got ((((((2^128)/1000)/60)/24)/365)/2) wrong the first time]

I understand that. I'm not disputing the fact that a 128 bit random integer is hard to guess.

The problem, however, is that it is being stored as a string. As such, if you decide to use the 32 character hex representation as a password, you're essentially storing a 32 character string that can only consist of 0-9a-f.

A random 32 character alphanumeric string would correspond to a random integer much larger than 128 bits, and as such, would be much stronger. There's no benefit to go with a weaker password.

No offense, but I think this argument is pretty silly. "dd" off 16 bytes from /dev/urandom and base64 it. You win; you just saved 7 characters.

Reply on news.ycombinator.com