News for hackers. Stuff that matters.

A comment on Twitch is hacked, and its source code leaked. Parent comment

Re:Twitch is hacked, and its source code leaked by growt on Thursday October 07, 2021 @05:06AM (#28783892)
"Use of a key derivation that employs a salt makes this attack infeasible." https://en.wikipedia.org/wiki/Rainbow_table

"Salts defend against attacks that use precomputed tables (e.g. rainbow tables)" https://en.wikipedia.org/wiki/Salt_(cryptography)

[ Parent | on HN ]
Re:Twitch is hacked, and its source code leaked by tyingq on Thursday October 07, 2021 @05:29PM (#28792329)
Salts do nothing for people with predictable passwords though. The salt is in the dump, so I can hash known plaintext with the algorithm and the dumped data.

Even if I can only hash a million a day, if your password is one of the top million most popular, and I have a good list, I'll have your password in a day. And if you re-used it...

Salts do make naïve brute-force, all-possible-strings approaches useless, yes.

[ Parent | on HN ]
Re:Twitch is hacked, and its source code leaked by growt on Friday October 08, 2021 @03:29AM (#28796629)
Yes, but nothing will make predictable passwords safe (at least when you have the hash). Enforcing password guidelines helps a bit.
[ Parent | on HN ]