News for hackers. Stuff that matters.
Re:Twitch is hacked, and its source code leaked by growt on Thursday October 07, 2021 @03:36AM (#28783317)
"Salting does not affect this attack in any way." Yes it does. If you habe unsalted passwords you can just use a rainbow table to look passwords up.
Re:Twitch is hacked, and its source code leaked by thaumasiotes on Thursday October 07, 2021 @04:20AM (#28783545)
And that is not affected by salting. You can use a rainbow table to look passwords up whether or not those passwords are salted. There is zero conceptual connection between the two ideas.

Now, realistically, you can't use a rainbow table on passwords of any noticeable length, and a salt may push the password over the edge of that threshold. If that's really what you want... enforce a minimum password length.

Re:Twitch is hacked, and its source code leaked by growt on Thursday October 07, 2021 @05:06AM (#28783892)
"Use of a key derivation that employs a salt makes this attack infeasible." https://en.wikipedia.org/wiki/Rainbow_table

"Salts defend against attacks that use precomputed tables (e.g. rainbow tables)" https://en.wikipedia.org/wiki/Salt_(cryptography)

Re:Twitch is hacked, and its source code leaked by tyingq on Thursday October 07, 2021 @05:29PM (#28792329)
Salts do nothing for people with predictable passwords though. The salt is in the dump, so I can hash known plaintext with the algorithm and the dumped data.

Even if I can only hash a million a day, if your password is one of the top million most popular, and I have a good list, I'll have your password in a day. And if you re-used it...

Salts do make naïve brute-force, all-possible-strings approaches useless, yes.

Re:Twitch is hacked, and its source code leaked by growt on Friday October 08, 2021 @03:29AM (#28796629)
Yes, but nothing will make predictable passwords safe (at least when you have the hash). Enforcing password guidelines helps a bit.