News for hackers. Stuff that matters.

A comment on Twitch is hacked, and its source code leaked. Parent comment

Re:Twitch is hacked, and its source code leaked by thaumasiotes on Wednesday October 06, 2021 @06:11PM (#28779133)
Password salting has nothing to do with password reuse.

Imagine two people have accounts on each of two websites:

             eBay           YouTube
   
   Alice     sunlight       bobrules
   
   Bob       bobrules       bobrules
A password reuse attack dumps the YouTube database, cracks Bob's password, and then accesses Bob's eBay account. The fix for this is that Bob should use different passwords on his different accounts. Hashing helps by making step 2 ("crack Bob's password") more difficult. Salting does not affect this attack in any way. Note that the attacker didn't bother to dump the eBay database.

The attack that salting protects against dumps the YouTube database, cracks Bob's password, and then accesses Alice's YouTube account.

[ Parent | on HN ]
Re:Twitch is hacked, and its source code leaked by growt on Thursday October 07, 2021 @03:36AM (#28783317)
"Salting does not affect this attack in any way." Yes it does. If you habe unsalted passwords you can just use a rainbow table to look passwords up.
[ Parent | on HN ]
Re:Twitch is hacked, and its source code leaked by thaumasiotes on Thursday October 07, 2021 @04:20AM (#28783545)
And that is not affected by salting. You can use a rainbow table to look passwords up whether or not those passwords are salted. There is zero conceptual connection between the two ideas.

Now, realistically, you can't use a rainbow table on passwords of any noticeable length, and a salt may push the password over the edge of that threshold. If that's really what you want... enforce a minimum password length.

[ Parent | on HN ]
Re:Twitch is hacked, and its source code leaked by growt on Thursday October 07, 2021 @05:06AM (#28783892)
"Use of a key derivation that employs a salt makes this attack infeasible." https://en.wikipedia.org/wiki/Rainbow_table

"Salts defend against attacks that use precomputed tables (e.g. rainbow tables)" https://en.wikipedia.org/wiki/Salt_(cryptography)

[ Parent | on HN ]
Re:Twitch is hacked, and its source code leaked by tyingq on Thursday October 07, 2021 @05:29PM (#28792329)
Salts do nothing for people with predictable passwords though. The salt is in the dump, so I can hash known plaintext with the algorithm and the dumped data.

Even if I can only hash a million a day, if your password is one of the top million most popular, and I have a good list, I'll have your password in a day. And if you re-used it...

Salts do make naïve brute-force, all-possible-strings approaches useless, yes.

[ Parent | on HN ]
Re:Twitch is hacked, and its source code leaked by growt on Friday October 08, 2021 @03:29AM (#28796629)
Yes, but nothing will make predictable passwords safe (at least when you have the hash). Enforcing password guidelines helps a bit.
[ Parent | on HN ]