3 ms·
The point here is that once you brute force the plaintext password, the same password might be used elsewhere.
by xorcist 5y ago
The point here is that once you brute force the plaintext password, the same password might be used elsewhere.
- mercurywells 5y agoWhat if you did something like hash(plaintext_pw+"twitchsalt") <browser> ---> <server> hash(browser_hash + db_salt)
- xorcist 5y agoThe browser_hash is now the password.
- growt 5y agoIf I understand this right, the problem is "twitchsalt" has to be known so that you can generate the same hash for future logins. So it's just one iteration of hashing more for a brute force attempt (modern hashing algorithms already use multiple iterations of hashing to make brute forcing harder)
- ocdtrekkie 5y agoWell, bear in mind, the hacker also has the exact code Twitch uses to salt it's hashes.