note 17410 deleted from function.md5 by jimw

Login delays have nothing to do with it. We're talking about calculating the password from the password-hash say, from /etc/shadow. If a hacker gets into your system to read the hashes, he'll crack the passwords sooner or later. Against a hash-based-attack, your password must have alot more than 16 bit entropy (as commonly-strong passwords have) - it must have more than 64 bits of entropy! Read the RFC about cryptographically-strong random numbers for info about how much entropy is in password, but the rule of thumb is: a letter in english (out of text with spaces and all) contains 1 bit of entropy. So, you'd need a sentence 64 letters long to be hard to crack. A typable letter (say, a random upper or lower case or digit) is about 6 bits of entropy, but damn hard to memorize.