3 ms·
You appear to not understand how password hashing works. A well designed hashing function is one-way, it cannot practically be reversed. With a large salt, even
by sbierwagen 15y ago
You appear to not understand how password hashing works. A well designed hashing function is one-way, it cannot practically be reversed. With a large salt, even very weak passwords ("cat") cannot be reversed.
https://secure.wikimedia.org/wikipedia/en/wiki/Password_hashing https://secure.wikimedia.org/wikipedia/en/wiki/Password_hash...
- Dylan16807 15y agoSalts only protect against rainbow tables. If you want to stop brute forcing you need a very slow hash like bcrypt. And you'll still be able to brute force "cat" in under a day.
- tptacek 15y agoNot only that, but the size of the "salt" has nothing to do with how long it takes to brute force a password. We should stop saying "salt" and start saying "randomizer" so at least people understand what that thing is doing; I think everyone understands intuitively that a hash can be "randomized enough" so that further randomization isn't a win.