Why would anyone use more than 128 bits of entropy in a password/passphrase? (24 characters alphanumeric with upper and lower case.) The answer: "I don't have to out-run the bear. I just have to out-run you!"
But when a website you're using is hacked, it's probably not your password database that's being attacked. It's probably that site's password hashing that's being attacked.
Comments
Why would anyone use more than 128 bits of entropy in a password/passphrase? (24 characters alphanumeric with upper and lower case.) The answer: "I don't have to out-run the bear. I just have to out-run you!"
And then protect it with a 128 bit AES key...
But when a website you're using is hacked, it's probably not your password database that's being attacked. It's probably that site's password hashing that's being attacked.