3 ms·
Then the rainbow table can only be used with this specific site. This makes it no more efficient than brute forcing. You can store the hashes yes, but you can a
by zhoutong 14y ago
Then the rainbow table can only be used with this specific site. This makes it no more efficient than brute forcing. You can store the hashes yes, but you can also include the cracked passwords in the dictionary and it takes only slightly more time to compute them even with unique salts.
Site-wide salting has almost the same security as per-user salt, as long as the salt is not leaked or cracked before the database is leaked for pre-computation.
- drivebyacct2 14y ago>This makes it no more efficient than brute forcing. Jesus, no. It absolutely does make it more efficient than brute forcing each password. I compute one rainbow table that I can run against 10,000 users. Or I brute force 10,000 users' passwords because they have unique salts. >_< God, I need to just accept the fact that people are going to talk out their ass about this and stop trying to get people to spread bad, insecure information. oh sweet jesus of irony, you're the guy that was wrapped up in Bitcoinica.
- zhoutong 14y agoOh, I got it. My brain wasn't working then. Don't worry, I use per-user salts for all my web projects following all security best practices that I know.
- chc 14y agoA database-wide salt makes cracking the database as hard as forcing one password. You only need to do the computation once and then you have a super-quick lookup for all the other hashes. Per-entry salts totally bust that.