News for hackers. Stuff that matters.

A comment on I mean, why not tell everyone our password hashes?. Parent comment

Re:I mean, why not tell everyone our password hashes? by visarga on Saturday July 15, 2017 @04:22AM (#14775636)
If you know the md5 hash, why not login with another password that generates the same hash value? Does it actually need to be the same passord?
[ Parent | on HN ]
Re:I mean, why not tell everyone our password hashes? by throwaway2016a on Saturday July 15, 2017 @03:41PM (#14778516)
It will work but a common reason to crack passwords is because people use the same password on multiple sites. Getting the wrong value may work to log into that specific site but will not work where the user the real password elsewhere. (unless that other place is using the same hash algorithm)
[ Parent | on HN ]
Re:I mean, why not tell everyone our password hashes? by cyphar on Saturday July 15, 2017 @04:27AM (#14775647)
Yes, that will also work, hence why rainbow tables don't need to contain more entries than the possible set of hashes.
[ Parent | on HN ]
Re:I mean, why not tell everyone our password hashes? by bitJericho on Saturday July 15, 2017 @08:37AM (#14776371)
That's called a collision
[ Parent | on HN ]