4 ms·
Salts are a thing for this very reason. And some hashes like scrypt can be parametrized to take time no matter what. There is no rainbow table entry for 012345
by BiteCode_dev 4y ago
Salts are a thing for this very reason. And some hashes like scrypt can be parametrized to take time no matter what.
There is no rainbow table entry for 0123456789+=i=i_fy82dnuf720g%2+70)(k$0@*qsijyn9&19n@1r0-l4ee) with 10000 scrypt rounds.
We are not in 2005 anymore, and we have better tools than md5, or even sha1 to do the job.
- eps 4y agoSalting won't work in this particular case. You need to match plaintext against a blacklist. Salt per entry is too expensive, salt per blacklist is exploitable.
- BiteCode_dev 4y agoWere it be a small company, we would try sharding salts + increasing the number of rounds of scrypt or some mix with a bloom filter. However, this is facebook. It's not too expensive for them.
- compsciphd 4y agohow does a salt help? a salt for a password is when we know the username and the salt so can combine the salt and provided password to compare against the generated hash value. in this case all we know is the phone number, how does a salt help us look up a given phone number in a set of salted / hashes if we dont know what salt to combine it with?
- BiteCode_dev 4y agoYou shard the number into groups with a salt for each, until you reach a number of combinations that is computable for FB size on a check request, but way too long pre-generate. You can combine it with some bloom like filter to increase efficiency.
- compsciphd 4y agoCan you more explain that as an example. I understand the words, but doesn't extend to me seeing the design of it.