Re:LivingSocial Hacked – 50 Million Customers Affected
by chill1 on Friday April 26, 2013 @06:52PM
(#5615969)
The point of unique salts is that even if all the user's passwords are the same, the end resulting hashes that are stored in the database, are different. So, let's say you wanted to hash your set of 50,000 different, commonly used passwords. You'd have to hash that list of 50k passwords for EACH individual user. So instead of 50,000 hashes... you have 50,000 x the total number of users.
[ Parent
| on HN ]
Re:LivingSocial Hacked – 50 Million Customers Affected
by wglb on Saturday April 27, 2013 @10:36AM
(#5617859)
I am not following your logic here.
What I am saying that if the attacker gets a row from the database that has the user's id, the password will be in a column labeled 'password'. Next column is likely to be the salt generated for that user's password, and let's say that this column name is 'salt'. With the salt and password for each user, you can run a dictionary across each combination at a furious rate.