note 17410 added to function.md5

Login delays have nothing to do with it. We're talking about calculating the password from the password-hash say, from /etc/shadow. If a hacker gets into your system to read the hashes, he'll crack the passwords sooner or later. Against a hash-based-attack, your password must have alot more than 16 bit entropy (as commonly-strong passwords have) - it must have more than 64 bits of entropy! Read the RFC about cryptographically-strong random numbers for info about how much entropy is in password, but the rule of thumb is: a letter in english (out of text with spaces and all) contains 1 bit of entropy. So, you'd need a sentence 64 letters long to be hard to crack. A typable letter (say, a random upper or lower case or digit) is about 6 bits of entropy, but damn hard to memorize. -- http://www.php.net/manual/en/function.md5.php http://master.php.net/manage/user-notes.php?action=edit+17410 http://master.php.net/manage/user-notes.php?action=delete+17410 http://master.php.net/manage/user-notes.php?action=reject+17410