4 ms·
From the perspective of trying to crack a single user's account the salt does not slow down non-precomputed attacks at all. From the perspective of trying to c
by vonmoltke 10y ago
From the perspective of trying to crack a single user's account the salt does not slow down non-precomputed attacks at all. From the perspective of trying to crack the entire database, or a significant portion of it, it multiples the work required by N (where N is the desired number of cracks to perform).
- rudolf0 10y agoI mean, it depends how you look at it. I consider precomputed attacks a special case of these attacks, sort of. In the security world, most password-predicting attacks are linear with respect to the amount of accounts you're trying to get passwords for. It's true that it will take a lot of hardware to efficiently attack all 65 million passwords. But in my field, big dumps like these are a godsend when doing a pentest. Looking to compromise a sysadmin's account? Search his/her emails and aliases in as many DB dumps as you can find, then expend a lot of resources cracking that one hash. If it's just a SHA-1 hash and the password isn't very strong, you won't have much trouble. Also a risk for people with vendettas against specific tumblr users (which, to my understanding, is a big issue on tumblr).