3 ms·
Hashes are mathematically proven to be irreversible except through rainbow tables (easily beaten with salting) or brute force. There's no faith needed (well, I
by benaiah 14y ago
Hashes are mathematically proven to be irreversible except through rainbow tables (easily beaten with salting) or brute force. There's no faith needed (well, I suppose that non-mathematicians like myself have to put faith in the math, but I trust the hundreds of independent studies of these algorithms quite well), and it's not anything close to "security through obscurity".
That said, you are right. You should always change passwords that are leaked. This, however, is due to the poor security practices of most companies, not some bizarre distrust of hashes.
- Joeri 14y agoBrute force was exactly what i was talking about. It doesn't matter whether a hash is broken through a mathematical flaw, or through improvements in the brute forcing process, if in practice it still gets broken. Once a hash is leaked brute force becomes possible in theory, and what is possible in theory is usually possible in practice with sufficient dedication. There have been such huge improvements in hashing through tools like hashcat and hardware implementations that i don't think it's unreasonable to distrust hashes. Once a hash is leaked you're essentially hoping that brute forcing it is too high of a cost. Given the history of order of agnitude improvements in hashing speed, i consider it unreasonable to believe that any password database remains safe indefinitely once leaked. I find your trust in the difficulty of brute forcing a hash just as bizarre as you seem to find my distrust of hashes.