Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass...
by ghshephard on Tuesday September 25, 2012 @05:04PM
(#4572649)
It's implicitly understood by everyone who cares about this topic that salting is intrinsic to KDFs. I.E. by the time you've read through, and understood http://codahale.com/how-to-safely-store-a-password/, you understand why "salting" your password gains you nothing, because rainbow tables are no longer particularly relevant to cracking passwords. And yes, while there is salting inherent to KDFs, that's not the major feature of them, but an assumed implementation detail.
[ Parent
| on HN ]
Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass...
by ZoFreX on Wednesday September 26, 2012 @04:06AM
(#4574649)
> rainbow tables are no longer particularly relevant to cracking passwords
If you use a common hash with no salt you can bet your britches the attacker will use rainbow tables!
It's also worth pointing out that rainbow tables aren't the only attack you are exposed to if you don't salt your passwords - it also prevents finding collisions, and massively slows down forward hashing attacks.
Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass...
by sk5t on Tuesday September 25, 2012 @10:30PM
(#4573929)
Negative on that. Not all algorithms produce the salt internally like bcrypt does--programmers must still be careful to supply a sufficiently lengthy random salt as input to PBKDF2, for example. Labeling folks who know this as stuck in the past or ignorant is a mistake.