Short passwords are vulnerable - and by short, we mean 8-characters

[robkelk]

The Register: Use an 8-char Windows NTLM password? Don't. Every single one can be cracked in under 2.5hrs

Or under 15 seconds if you have applicable rainbow tables and a GPU. (And who doesn't have a GPU nowadays?)


IMHO, this xkcd strip has a good idea but doesn't implement it correctly. (For one thing, Mr. Munroe implies his password is 25 elements {letters} long when it's actually 4 elements {common dictionary words} long.)