4 ms·

'bEanx' in practice destroys every rainbow table in existence. It's on the line probabilisticly, so I can't make a harder statement, but 20 characters (which t

'bEanx' in practice destroys every rainbow table in existence. It's on the line probabilisticly, so I can't make a harder statement, but 20 characters (which takes the programmer 2 more seconds to smash in) takes us to computers the size of the earth conversation which ok you win, it is possible :) > the salt has to be stored on a per-user basis. That's of no use to stop Rainbow tables. One salt across the site is fine to destroy or not destroy Rainbow tables. Either 'bEanx' or “For Sale: Baby shoes, never worn.” will work fine commonly used on all passwords. A common salt is not great for brute force though, but that's a different topic.

thaumasiotes 5y ago
> 'bEanx' in practice destroys every rainbow table in existence. Yes, as your link (well, part 2) notes, publicly available rainbow tables are available up to 8 mixed-case characters or 10 lowercase characters. Salting with "2" is sufficient to avoid them. That is because rainbow tables cannot practically attack long passwords. >> the salt has to be stored on a per-user basis. > That's of no use to stop Rainbow tables. I didn't say it was. It's a requirement of salting. Salting is unrelated to rainbow tables. Instead, it defends against comparing one user's hashed password to a second user's hashed password, which I assume is what you're referring to when you say "not great for brute force". All I said here was that the salt is unlikely to be a book, because that imposes a very large per-user storage burden.
- aaron695 5y ago
  > That is because rainbow tables cannot practically attack long passwords. It's trivial to create a rainbow table that attacks passphrases. This statement is wrong. You example 1000102772901 is easily within rainbow tables. Trivially so, it's worse than a passphrase. > it defends against comparing one user's hashed password to a second user's hashed password, This has zero value. I can only suggest you do a course on hash functions on Coursera, the mathematics is somewhat easy and interesting to know. It's fun to follow up with a Blockchain course also has very interesting mathematics around hash functions, I really enjoyed this. I can't suggest which, the one I did isn't available, but check Google reviews there's a few out there.
  - thaumasiotes 5y ago
    >> it defends against comparing one user's hashed password to a second user's hashed password, > This has zero value. I find it disturbing that you would say this. The purpose of salting passwords is to block this attack. Please familiarize yourself with the field before opining on what its goals are.

thaumasiotes 5y ago

> 'bEanx' in practice destroys every rainbow table in existence. Yes, as your link (well, part 2) notes, publicly available rainbow tables are available up to 8 mixed-case characters or 10 lowercase characters. Salting with "2" is sufficient to avoid them. That is because rainbow tables cannot practically attack long passwords. >> the salt has to be stored on a per-user basis. > That's of no use to stop Rainbow tables. I didn't say it was. It's a requirement of salting. Salting is unrelated to rainbow tables. Instead, it defends against comparing one user's hashed password to a second user's hashed password, which I assume is what you're referring to when you say "not great for brute force". All I said here was that the salt is unlikely to be a book, because that imposes a very large per-user storage burden.

aaron695 5y ago
> That is because rainbow tables cannot practically attack long passwords. It's trivial to create a rainbow table that attacks passphrases. This statement is wrong. You example 1000102772901 is easily within rainbow tables. Trivially so, it's worse than a passphrase. > it defends against comparing one user's hashed password to a second user's hashed password, This has zero value. I can only suggest you do a course on hash functions on Coursera, the mathematics is somewhat easy and interesting to know. It's fun to follow up with a Blockchain course also has very interesting mathematics around hash functions, I really enjoyed this. I can't suggest which, the one I did isn't available, but check Google reviews there's a few out there.
- thaumasiotes 5y ago
  >> it defends against comparing one user's hashed password to a second user's hashed password, > This has zero value. I find it disturbing that you would say this. The purpose of salting passwords is to block this attack. Please familiarize yourself with the field before opining on what its goals are.