News for hackers. Stuff that matters.
Re:65M Tumblr Passwords for Sale on TheRealDeal by vonmoltke on Tuesday May 31, 2016 @03:44PM (#11809554)
From the perspective of trying to crack a single user's account the salt does not slow down non-precomputed attacks at all. From the perspective of trying to crack the entire database, or a significant portion of it, it multiples the work required by N (where N is the desired number of cracks to perform).
Re:65M Tumblr Passwords for Sale on TheRealDeal by rudolf0 on Tuesday May 31, 2016 @04:54PM (#11810149)
I mean, it depends how you look at it.

I consider precomputed attacks a special case of these attacks, sort of. In the security world, most password-predicting attacks are linear with respect to the amount of accounts you're trying to get passwords for.

It's true that it will take a lot of hardware to efficiently attack all 65 million passwords. But in my field, big dumps like these are a godsend when doing a pentest.

Looking to compromise a sysadmin's account? Search his/her emails and aliases in as many DB dumps as you can find, then expend a lot of resources cracking that one hash. If it's just a SHA-1 hash and the password isn't very strong, you won't have much trouble.

Also a risk for people with vendettas against specific tumblr users (which, to my understanding, is a big issue on tumblr).