News for hackers. Stuff that matters.
Re:No Cookie for You by jedberg on Thursday December 17, 2020 @02:41PM (#25459465)
To an extent, but there are easy ways to cut the search space. For example, you could make a unique request with garbage on it from a known IP every day, and then all you have to do is build a rainbow table for that one IP to find out what the salt is for each day, and then you can fully reconstruct the logs.
Re:No Cookie for You by mattlondon on Thursday December 17, 2020 @03:38PM (#25460096)
If the salt is a random 64bit number (for example) then "finding out" the salt is not trivial.
Re:No Cookie for You by wpietri on Thursday December 17, 2020 @05:25PM (#25461325)
And unless I'm missing something, it seems easy to add plenty of bits to the salt until it's no longer practical to reverse.
Re:No Cookie for You by YetAnotherNick on Thursday December 17, 2020 @03:49PM (#25460223)
@mattlondon: The salt is known to plausible, that is the only way someone can hash it.