Re:Disqus Security Alert: User Info Breach
by akvadrako on Saturday October 07, 2017 @04:20AM
(#15422881)
If you are attacking just one password, that makes sense. But if you want to check all the compromised accounts for easy to guess passwords, a salt will increase the cost.
[ Parent
| on HN ]
Re:Disqus Security Alert: User Info Breach
by wolf550e on Saturday October 07, 2017 @11:20AM
(#15424088)
Salt won't save you. For checking most common passwords against stolen database, you try the top one million most common passwords against each hash, at a rate of 200,000 hashes per second.
A dictionary-based attack that tries variants and inserts digits and spends one second per hash will catch the less common passwords.