4 ms·
Salts don't save you from an attacker who can calculate millions of hashes per second on a GPU. Using bcrypt/scrypt/Argon2id does.
by owenmarshall 9y ago
Salts don't save you from an attacker who can calculate millions of hashes per second on a GPU.
Using bcrypt/scrypt/Argon2id does.
- TheRealPomax 9y agoSalt is not intended to save you, just to make unhashing the next user's password just as much work as the one you just cracked.
- wongarsu 9y agoSalting is incredibly effective. Without salting, the entire power of the attacker can be used against all password hashes at once. With salting, those millions of hashes per second translates to only being able to crack simple passwords, or only the passwords of a few users.
- tedunangst 9y agoExcept in the case of MD5, it's billions, many billions, of hashes per second, which translates to cracking lots of users' passwords.