News for hackers. Stuff that matters.
Re:Auditor's response to "Our security auditor is an idiot" ... by gus_massa on Friday July 29, 2011 @09:56AM (#2821734)
If you use a different salt for each modification of the old password, you must compute the all the hashes of the new password.

Another problem is that to prevent the use of the very old passwords, you should keep the hashes of the modifications. To make the comparations fast, you have to use the same hash.

Now you have a list of #password-changes * #passwords-modifications, and if an intruder get them, it is possible to make a mini-rainbow attack.

There are no comments on this comment yet.