4 ms·
Having faith in the security of the hash that has been leaked was always a ticking clock. Better to just rotate any password you know to have been compromised.
by AdmiralAsshat 9y ago
Having faith in the security of the hash that has been leaked was always a ticking clock. Better to just rotate any password you know to have been compromised.
- gmuslera 9y agoThose hashes comes from leaked plain text passwords lists originally. They were already released in plain text. The hashing of Have I been Pwned are just a way to not release even further those passwords (to newcomers, hobbysts and general public), but the hacking community was already using them in dictionary attacks.
- kevin_thibedeau 9y agoSeems like HIBP should be using a fixed salt on its hashes.
- __david__ 9y agoBecause of the way HIPB works the salt would need to be both constant and known by the client which makes it rather useless as a salt. It only would stop rainbow tables, but that's not the issue here.
- lucb1e 9y agos/know/suspect/