Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I understand that. I'm not disputing the fact that a 128 bit random integer is hard to guess.

The problem, however, is that it is being stored as a string. As such, if you decide to use the 32 character hex representation as a password, you're essentially storing a 32 character string that can only consist of 0-9a-f.

A random 32 character alphanumeric string would correspond to a random integer much larger than 128 bits, and as such, would be much stronger. There's no benefit to go with a weaker password.



No offense, but I think this argument is pretty silly. "dd" off 16 bytes from /dev/urandom and base64 it. You win; you just saved 7 characters.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: