3 ms·
No, it's still best practice. The problem is it's impossible to protect weak passwords, because attackers can just run a password database through your hashing
by shawabawa3 12y ago
No, it's still best practice.
The problem is it's impossible to protect weak passwords, because attackers can just run a password database through your hashing algorithm and see if there are any matches.
i.e. Just because you can't reverse a hash to get the password, doesn't mean you can't hash a bunch of passwords to figure out which leads to which hash
- wastedhours 12y agoThanks for making that point - that's been going around my head for a few weeks whilst pondering on password encryption. Rainbow table attacks are still more than possible with all of these algorithms when used on their own? So salts are certainly the way to go, as, although they're "known" (appended to hash, or stored elsewhere in DB), the hash can't be compared to a generic table, it'd need to be a full dictionary table of hashes already encrypted with that salt (which theoretically/hopefully is used only once)?