News for hackers. Stuff that matters.

A comment on Yahoo discloses hack of 1B accounts. Parent comment

Re:Yahoo discloses hack of 1B accounts by leereeves on Wednesday December 14, 2016 @07:25PM (#13181127)
Most people here don't seem to understand the difference between collision and preimage attacks. So they're overreacting to the fact Yahoo used MD5.

Storing unsalted passwords, however, would be a huge mistake, if Yahoo did so as someone here claimed.

There are precomputed lookup tables for the unsalted hashes of many, many passwords (both MD5 and more secure hashes) and cracking unsalted passwords is simply a database lookup.

[ Parent | on HN ]
Re:Yahoo discloses hack of 1B accounts by rev_bird on Wednesday December 14, 2016 @08:17PM (#13181468)
Ah ha! There's the weakness I was missing, thank you so much for responding. I hadn't even thought of it that way---I knew salts shook up the resulting hashes, but an actual benefit of it is that it makes it pretty much impossible to do any "homework" (rainbow tables) ahead of time.
[ Parent | on HN ]