I don't get the fascination with MD5 cracking speeds. If you use different passwords for each site, a 7 character lowercase password would take 10 years to exhaust the password-space if a site limits you to 20 attempts per second. As long as you are using different, random passwords for each site, you can just change for password for InsecureApp once InsecureApp gets hacked.
I think we should be educating people on using different passwords for services rather than convincing them to use very long, complex passwords.
I use so many different services/sites that having a different password for each one is unrealistic. Here's a small sample: Personal email, work email, version control at work, Github, bank, university systems, personal computer, work computer, Facebook, Hacker News, Reddit, Steam, Skype, ... I could go on. In order to keep track of all of these unique passwords, I would need some kind of protected database like 1Password [0] (which I do have), or a notebook with them all written down. At this point, however, cracking/guessing a single password or obtaining a physical notebook has given someone access to all of my accounts.
What I typically do is give "important" services unique, random passwords (bank, personal email, work email; things that can do damage), and use one of a set of passwords for everything else. If one password gets found, then maybe only my Reddit, Skype and a few forum accounts are compromised. This has the advantage that I use the unique password frequently enough to memorize them, and non-unique passwords are used in a few places which results in them also being used enough that they are memorized.
Comments
I don't get the fascination with MD5 cracking speeds. If you use different passwords for each site, a 7 character lowercase password would take 10 years to exhaust the password-space if a site limits you to 20 attempts per second. As long as you are using different, random passwords for each site, you can just change for password for InsecureApp once InsecureApp gets hacked.
I think we should be educating people on using different passwords for services rather than convincing them to use very long, complex passwords.
I use so many different services/sites that having a different password for each one is unrealistic. Here's a small sample: Personal email, work email, version control at work, Github, bank, university systems, personal computer, work computer, Facebook, Hacker News, Reddit, Steam, Skype, ... I could go on. In order to keep track of all of these unique passwords, I would need some kind of protected database like 1Password [0] (which I do have), or a notebook with them all written down. At this point, however, cracking/guessing a single password or obtaining a physical notebook has given someone access to all of my accounts.
What I typically do is give "important" services unique, random passwords (bank, personal email, work email; things that can do damage), and use one of a set of passwords for everything else. If one password gets found, then maybe only my Reddit, Skype and a few forum accounts are compromised. This has the advantage that I use the unique password frequently enough to memorize them, and non-unique passwords are used in a few places which results in them also being used enough that they are memorized.
[0] https://agilebits.com/onepassword