4 ms·
His analogy to exposing password hashes doesn't really work. The primary reason you don't expose password hashes isn't that someone will break the hashing algo
by ianferrel 15y ago
His analogy to exposing password hashes doesn't really work.
The primary reason you don't expose password hashes isn't that someone will break the hashing algorithm. It's that users come up with crappy passwords, and exposing the hashes would let an attacker do a brute-force search on the likely password space.
His other points are pretty good, though.
- pmylund 15y agoGood point. Let's say, for the sake of argument, that each of them have their own salt :)
- JoachimSchipper 15y agoAny reasonable password algorithm will have a unique salt for each password (well, a random long salt; you're highly unlikely to have collisions). Dictionary attacks still work.
- pmylund 15y agoRight. The analogy isn't bulletproof, but in conclusion it's pretty dumb to share information that could conceivably be used to extract some information or otherwise get an advantage when there's no reason to.