3 ms·

Theoretically, no, but in practice if you know that "password123" hashes to "blaHb1ah" then you get a DB of hashed passwords and see "blaHb1ah", you probably kn

by skizm 6y ago

Theoretically, no, but in practice if you know that "password123" hashes to "blaHb1ah" then you get a DB of hashed passwords and see "blaHb1ah", you probably know that person's password is "password123". (which is why you use salts to fix that). For all intents and purposes I just reversed the hash in this context.

aaomidi 6y ago
Kinda? But there's infinite number of other things that will hash to that same value. So you can assume (probably with good certainty) that you've got the correct password, but you can't be sure. So pedantically speaking, it's not really reversible.
- zamfi 6y ago
  > So you can assume (probably with good certainty) that you've got the correct password, but you can't be sure. That's assuming no other constraints. If the constraints on the password are strong enough (for example, must include letters, numbers, special characters, and be less than 30 characters) that there really may be only one input that satisfies those constraints and also hashes to the found value.
  - aaomidi 6y ago
    100% true.
- skykooler 6y ago
  True. However, in most circumstances, finding a input that hashes to that value is equivalent to reversing the hash. For example, if your password is "password", and that hashes to "blahblah", and I find that "foobar" also hashes to "blahblah", then I can log into your account with password "foobar" even though that wasn't your original password.
  - oarsinsync 6y ago
    > However, in most circumstances, finding a input that hashes to that value is equivalent to reversing the hash. In most circumstances, is guessing your smartphone's pin code is equivalent to hacking the security of your phone? In both examples, the end result is the same, but the process is absolutely not. Reversing a hash is a general solution that can be reapplied in all circumstances, much like finding a security exploit to bypass the lockscreen of your phone. Looking up a hash in a rainbow table that matches is much like guessing your PIN. It works for that one specific case. It is not a generalised solution across the board.
- chpmrc 6y ago
  I appreciate that you specified "pedantically". A whole thread on an inaccurate use of the word "reverse". Oh boy!

by skizm 6y ago

aaomidi 6y ago

Kinda? But there's infinite number of other things that will hash to that same value. So you can assume (probably with good certainty) that you've got the correct password, but you can't be sure. So pedantically speaking, it's not really reversible.

zamfi 6y ago
> So you can assume (probably with good certainty) that you've got the correct password, but you can't be sure. That's assuming no other constraints. If the constraints on the password are strong enough (for example, must include letters, numbers, special characters, and be less than 30 characters) that there really may be only one input that satisfies those constraints and also hashes to the found value.
- aaomidi 6y ago
  100% true.
skykooler 6y ago
True. However, in most circumstances, finding a input that hashes to that value is equivalent to reversing the hash. For example, if your password is "password", and that hashes to "blahblah", and I find that "foobar" also hashes to "blahblah", then I can log into your account with password "foobar" even though that wasn't your original password.
- oarsinsync 6y ago
  > However, in most circumstances, finding a input that hashes to that value is equivalent to reversing the hash. In most circumstances, is guessing your smartphone's pin code is equivalent to hacking the security of your phone? In both examples, the end result is the same, but the process is absolutely not. Reversing a hash is a general solution that can be reapplied in all circumstances, much like finding a security exploit to bypass the lockscreen of your phone. Looking up a hash in a rainbow table that matches is much like guessing your PIN. It works for that one specific case. It is not a generalised solution across the board.
chpmrc 6y ago
I appreciate that you specified "pedantically". A whole thread on an inaccurate use of the word "reverse". Oh boy!