5 ms·
While technically true, this seems like it would be computationally infeasible, or at least impractical, given that they were not just hashing but also salting
by rifung 12y ago
While technically true, this seems like it would be computationally infeasible, or at least impractical, given that they were not just hashing but also salting the passwords.
Of course, I barely know anything about computer security, but at least it should prevent attacks using rainbow tables I think?
- MichaelGG 12y agoNo, a simple password like "slack123" should be easy to crack with any usable password storage method.
- coldcode 12y agoWith a separate salt for each password not even the NSA can crack that (that we know of). With a single salt for all of them, maybe.
- nevir 12y agoSure they can. Anyone can. It just takes a long time per password to crack (that time is a function of the cost/# of rounds of the hashing function).
- nevir 12y agoNot necessarily easy. If they're using a decently high cost for their use of bcrypt, we're talking hours to days (or more) per user, even when only considering weak passwords like that.
- rifung 12y agoTrue, I guess it's possible to crack a password for a single user, especially one with a weak password. I was more thinking that it's unlikely they'll be able to crack the passwords of everyone who was in their database, and given that Slack has so many users it's unlikely for any single person that his/her password will be cracked. Of course, even if they can't steal everyone's passwords, maybe the hackers will try to crack the passwords of higher profile targets.
- nitrogen 12y agoGPUs are fast enough to crack a very large percentage of passwords in a short time by brute force, if a simple algorithm was used, even with salt.