3 ms·
You complained about them salting using the public username as salt. You asserted that this makes the rainbow table computable offline. I asserted that this did
by lmz 2y ago
You complained about them salting using the public username as salt. You asserted that this makes the rainbow table computable offline. I asserted that this didn't matter much for security since the table for H(username || secret) is username specific and not reusable for other usernames. Since precomputed rainbow tables consume quite a bit of space it is rather unlikely that anyone would have such a table stored for any random username.
- heliosyne 2y agoI didn't complain about anyone. The Okta vulnerability isn't because of public salts.
- vlovich123 2y agoYou can still build a rainbow table for a specific username if you want to do a targeted attack.