Quote from: Rob P. on June 19, 2011, 08:44:22 PM

Of course users should:
1) Have a 15+ character password.

A hashing calculation: at one billion hash comparisons a second, a 15 character alphanumeric password will take roughly 7000000 years to compare all combinations.

Quote from: BioMike on June 19, 2011, 08:50:10 PM

Aren't you reducing your key space then? Making it less secure.

No, running the result through the hash function again is a very common way to make it safer.
What you basically do is, if they can figure it out, is force them to do multiple hashes for every comparison. This is a direct counter to brute-force attacks.
If they have to spend one second for EVERY combination comparison, then it will be basically impossible for them to brute-force anything.
There are even specific algorithm which are designed just for this.

If you take the above calculation, if they can only do one comparison per second instead of a billion, then it will take 7000000000000000 years instead to test all combinations for one password.