chick3nman

Mode 2000 is not a "real" mode and shouldn't be considered in terms of password security. It's just an empty kernel we use for producing candidates on stdout.

LM is still this way, the algorithm hasn't changed, it's just not often used/stored except in the case of quite old legacy systems. NT hashes, commonly referred to as NTLM hashes, are indeed not length restricted and do not break your password up into 7 + 7 chunks.

The math says 12+ if randomly generated by something like a password manager and including uppercase, lowercase, numbers, and symbols. 95^12 is too big for pretty much anyone to crack for a very long time, if ever. There is a small caveat to this regarding what type of hashing is being used though. In nearly all cases, even in the case of relatively weak hashes, 12+ is enough, but there are hashes which truncate or break up inputs. Windows LanMan(LM) is probably the most common offender still seen these days that does this and any LM will always be breakable up to 14 characters due to its underlying algorithm leading to a weak separation of 7 + 7 characters. In the case of Windows hashing a default length of 15+ can help to avoid LM being stored but for legacy systems it may be unavoidable.

They base their math on SHA256, which is not a hash function anyone should be using for password hashing, being cracked by bitcoin ASICs, which are completely irrelevant to hash cracking because they are incapable of doing the required math in their current form. They are ASICs, they do 1 thing and 1 thing only, and it's not crack passwords hashed with SHA256 sadly.

This fundamental problem with their argument either shows a serious lack of understanding regarding the subject of password hashing/cracking or it's simply being done because they don't expect their readers to understand it. Given the product they are pushing, I'm uncomfortable with both scenarios.

Passwords should be hashed with Bcrypt or Argon2, maybe Scrypt or PBKDF2 in some special cases. https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor...