How I became a password cracker

Re:How I became a password cracker by daeken on Monday March 25, 2013 @06:48AM (#5436383)

This is a million degrees of wrong. With bcrypt, scrypt, and PBKDF2, there is no "adding a salt". It's an inherent part of each algorithm. If you're "building" a salt, you're doing it wrong, period.

> It's trivial to build a lookup table like with md5, it just takes longer.

No, that's not true, because each one is initialized with a completely different public salt. You can't generate lookup tables for it, without covering the entire hash space.

[ Parent | on HN ]

Re:How I became a password cracker by raverbashing on Monday March 25, 2013 @07:16AM (#5436447)

- there is no "adding a salt"

Of course there is. As you said, it's an inherent part of the algorithm. But never put it beyond some people to use a trivial salt (or use the same one for all users)

"because each one is initialized with a completely different public salt"

If they follow the proper procedures, yes, building a lookup table is impossible.

[ Parent | on HN ]

Re:How I became a password cracker by d4n3 on Monday March 25, 2013 @07:35AM (#5436492)

The actual output from the bcrypt library is: [salt]$[hash]

You don't set the salt yourself, the library generates it from from a secure RNG.

For someone that's not that into security, it's easy to use and hard to get wrong.

[ Parent | on HN ]

Re:How I became a password cracker by raverbashing on Monday March 25, 2013 @07:55AM (#5436521)

Thanks for clarifying

Checking the python libraries they make it really easy to use, but you can provide your own salt if you want (you have to manually call 'gensalt' as well)

So pretty safe if you copy their examples.

[ Parent | on HN ]