Cougar on "Man who wrote password guidelines says he got it all wrong...."

Pffff! You can decrypt MD5 online no need for a PC.

You can decrypt many MD5 hashes simply by Googling the hash.

In the good ol days of NT passwords that Cougar mentioned you'd have L0phtCrack banging away trying dictionary and rainbow table attacks.

Indeed (that's what I was referring to earlier when I was talking about password audits).

This is doubly easy because of the way NT stored passwords. Essentially, passwords were encrypted in six-character chunks. So our correcthorsebatterystaple would be held as CORREC THORSE BATTER YSTAPL E. And as discussed, you can brute-force six-character passwords with a broken biscuit.