3 ms·
> If the salts are unique to the user wouldn't it be nearly impossible for the hacker to use the hashed pw on other sites Even if the salts aren't unique, can
by sudshekhar 9y ago
> If the salts are unique to the user wouldn't it be nearly impossible for the hacker to use the hashed pw on other sites
Even if the salts aren't unique, can you explain how can they use the hashed password anywhere?
If I give you a hashed password and the salt used, what exactly can you do with it? (apart from brute forcing)
- MichaelGG 9y agoFor instance, you can make a list of the top 100,000 passwords, plus another 1000-per-user variations (based on username or email or whatever). Now run them against all users. You'll get some successes, and now those users are at risk. A password DB breach, salted or not, allows an offline, non-rate-limited, attack on those passwords.