Twitch is hacked, and its source code leaked

Re:Twitch is hacked, and its source code leaked by thaumasiotes on Thursday October 07, 2021 @04:20AM (#28783545)

And that is not affected by salting. You can use a rainbow table to look passwords up whether or not those passwords are salted. There is zero conceptual connection between the two ideas.

Now, realistically, you can't use a rainbow table on passwords of any noticeable length, and a salt may push the password over the edge of that threshold. If that's really what you want... enforce a minimum password length.

[ Parent | on HN ]

Re:Twitch is hacked, and its source code leaked by growt on Thursday October 07, 2021 @05:06AM (#28783892)

"Use of a key derivation that employs a salt makes this attack infeasible." https://en.wikipedia.org/wiki/Rainbow_table

"Salts defend against attacks that use precomputed tables (e.g. rainbow tables)" https://en.wikipedia.org/wiki/Salt_(cryptography)

[ Parent | on HN ]

Re:Twitch is hacked, and its source code leaked by tyingq on Thursday October 07, 2021 @05:29PM (#28792329)

Salts do nothing for people with predictable passwords though. The salt is in the dump, so I can hash known plaintext with the algorithm and the dumped data.

Even if I can only hash a million a day, if your password is one of the top million most popular, and I have a good list, I'll have your password in a day. And if you re-used it...

Salts do make naïve brute-force, all-possible-strings approaches useless, yes.

[ Parent | on HN ]

Re:Twitch is hacked, and its source code leaked by growt on Friday October 08, 2021 @03:29AM (#28796629)

Yes, but nothing will make predictable passwords safe (at least when you have the hash). Enforcing password guidelines helps a bit.

[ Parent | on HN ]