| Character set | Password length | Time to try all combinations |
|---|---|---|
| Lowercase | 6 | 45 seconds |
| Lowercase | 7 | 19 minutes 35 seconds |
| Lowercase | 8 | 8 hours 29 minutes 18 seconds |
| Lowercase | 9 | 9 days 4 hours 42 minutes 4 seconds |
| Lowercase | 10 | 239 days 2 hours 13 minutes 50 seconds |
| Lowercase | 11 | 17 years 7 days 7 hours 10 minutes 49 seconds |
| Uppercase lowercase | 6 | 47 minutes 16 seconds |
| Uppercase lowercase | 7 | 1 days 16 hours 58 minutes 12 seconds |
| Uppercase lowercase | 8 | 88 days 18 hours 26 minutes 55 seconds |
| Uppercase lowercase | 9 | 12 years 233 days 1 hours 35 minutes 2 seconds |
| Uppercase lowercase numbers | 6 | 2 hours 15 minutes 23 seconds |
| Uppercase lowercase numbers | 7 | 5 days 19 hours 53 minutes 56 seconds |
| Uppercase lowercase numbers | 8 | 361 days 9 hours 44 minutes 35 seconds |
| Uppercase lowercase numbers | 9 | 61 years 127 days 9 hours 29 minutes 30 seconds |
| Uppercase lowercase numbers symbols | 6 | 1 days 3 hours 15 minutes 12 seconds |
| Uppercase lowercase numbers symbols | 7 | 106 days 17 hours 50 minutes 4 seconds |
| Uppercase lowercase numbers symbols | 8 | 27 years 172 days 7 hours 29 minutes 40 seconds |
1) NEVER EVER USE THE USERNAME AS A SALTYes, I'm aware of the terrible choice of a salt and hashing algorithm. I would have personally preferred bcrypt, myself, but please note that the method used was set by the creators of SMF. I'm under the impression they chose it to accommodate those who insist on using outdated versions of PHP.
2) WHAT HASH ARE YOU USING?
Oh come on. This is not a forum where big monies are circulating. If an account gets hacked, it will not be an end of the world for the user, in the worst case scenario he needs to redo it. Even if it is very easy to find out the password, what are the chances, they will chose YOUR account, if even they find out this SITE. And even after that, they would need to find your valuable accounts (paypal, steam, email). This is just random forum. I understand people who are more important on this forum will protect their account, but for random users, there is no need for exaggerated security.I think you misunderstand. We already have methods to prevent attempts to brute force into accounts on our site. That's not what this change is hoping to protect against. Rather, this is largely focused against password reuse. Too many people reuse passwords on other sites (including banking and email). If you used the same password here as your gmail account, it's practically a given that a hacker would be able to link the two together. That's the main reason small sites are hacked: to get passwords that can be used on larger sites.
Also account deactivation for 3 months is too short, many leave to later rejoin, I came back here after almost a year.That may be true, but at the same time, three months is a long while, and users merely have to change their password to keep their account activated indefinitely. Even if their account is deleted, they can recreate accounts easily enough (and there's a fair chance that after more than three months, they wouldn't remember their password, anyway). Finally, we will not be removing accounts with a large number of posts, so it will most likely be a large number of spam accounts and single-post accounts which end up being deleted. The kind of accounts that are unlikely to return to the forum if they don't respond to the email.