League of Legends database compromised, passwords hashed without salt

Re:League of Legends database compromised, passwords hashed ... by zhoutong on Saturday June 09, 2012 @03:01AM (#4087475)

Then the rainbow table can only be used with this specific site. This makes it no more efficient than brute forcing. You can store the hashes yes, but you can also include the cracked passwords in the dictionary and it takes only slightly more time to compute them even with unique salts.

Site-wide salting has almost the same security as per-user salt, as long as the salt is not leaked or cracked before the database is leaked for pre-computation.

[ Parent | on HN ]

Re:League of Legends database compromised, passwords hashed ... by chc on Saturday June 09, 2012 @03:39AM (#4087539)

A database-wide salt makes cracking the database as hard as forcing one password. You only need to do the computation once and then you have a super-quick lookup for all the other hashes. Per-entry salts totally bust that.

[ Parent | on HN ]

Re:League of Legends database compromised, passwords hashed ... by drivebyacct2 on Saturday June 09, 2012 @03:22AM (#4087512)

>This makes it no more efficient than brute forcing.

Jesus, no. It absolutely does make it more efficient than brute forcing each password.

I compute one rainbow table that I can run against 10,000 users. Or I brute force 10,000 users' passwords because they have unique salts.

>_< God, I need to just accept the fact that people are going to talk out their ass about this and stop trying to get people to spread bad, insecure information.

oh sweet jesus of irony, you're the guy that was wrapped up in Bitcoinica.

[ Parent | on HN ]

Re:League of Legends database compromised, passwords hashed ... by zhoutong on Saturday June 09, 2012 @10:39PM (#4090001)

Oh, I got it. My brain wasn't working then.

Don't worry, I use per-user salts for all my web projects following all security best practices that I know.

[ Parent | on HN ]