3 ms·
They have the db dumps, so yes, they know the usernames. And they used a rainbow table[1] to break the md5 hashes, which is a lot cheaper than brute-forcing. [
by felixhandte 11y ago
They have the db dumps, so yes, they know the usernames. And they used a rainbow table[1] to break the md5 hashes, which is a lot cheaper than brute-forcing.
[1] (https://en.wikipedia.org/wiki/Rainbow_table https://en.wikipedia.org/wiki/Rainbow_table)
- aruggirello 11y agoThen would replacing md5() with hash_hmac('sha256' [= or whatever ], strtolower($username) [= data ], strtolower($password) [= key ] ) help against such an attack? If I understand correctly, this would have ruled out rainbow tables. Edit: clarified. BTW hash_hmac is built-in with PHP >= 5.1.2.
- sbov 11y agoThe problem isn't just rainbow tables. Md5 is a fast algorithm. Sha256 isn't much slower than md5. You want anything auth related hashed using a slow algorithm - speed is your enemy. That's why bcrypt and the like are popular, because you can adjust how long it will take to calculate.