News for hackers. Stuff that matters.
Re:How Rainbow Tables Work by marcosdumay on Tuesday November 24, 2020 @04:57PM (#25203414)
Whatever you can do online with a GPU, you can do much in an offline session stored in a file.

Sharing rainbow tables over the internet is probably dead, but your disks can keep more hashes than you can calculate quickly.

Re:How Rainbow Tables Work by jorge_leria on Tuesday November 24, 2020 @07:47PM (#25204760)
A new GPU is able to calculate ~50,000 million MD5 hashes per second, an MD5 hash is stored typically on a 32 bytes hex string. If you want to store that you'll need more than 1TB per second: https://gist.github.com/Chick3nman/bb22b28ec4ddec0cb5f59df97...

I used MD5 because that's the typical hash you find unsalted on leaks, but if you do the math with others it is almost impossible to find an example where storing beats using a GPU to crack (even an older one) for a couple of hours.

Re:How Rainbow Tables Work by codefined on Tuesday November 24, 2020 @08:21PM (#25204969)
Are there any archaic hashes that are built to be "slow" where this might not apply? It feels like a lot of modern slow hashes have salts built in (e.g. Bcrypt, Scrypt, Argon2) but if one didn't use a salt it would definitely still make sense to use a rainbow table against these hashes.

Is the idea that password hashes should be slow relatively new?

Re:How Rainbow Tables Work by lostcolony on Tuesday November 24, 2020 @10:33PM (#25205772)
No, the idea that password hashing should be slow is built into the basic understanding of what password hashing is for and should do.

It's just that security wasn't as important (limited web attack surface) or generally understood back in the day (so people were even less likely to ask "is this hash suitable for passwords rather than checksums/indexing/etc?" than they are today), or the slow ones from then were fine -then-, but advances in hardware, the availability of the cloud/GPUs (so massive parallelization without a cost of infrastructure only a nation state could afford), etc, means they're easily compromised today.

Re:How Rainbow Tables Work by marcosdumay on Wednesday November 25, 2020 @07:18PM (#25215742)
The GP is correct, and I made some mistake on my estimation.

The idea that password hashes should be slow is indeed relatively new. Also it's contemporary to the idea that algorithms should have salts builtin, so those features usually go together.