News for hackers. Stuff that matters.

A comment on LivingSocial Hacked – 50 Million Customers Affected. Parent comment

Re:LivingSocial Hacked – 50 Million Customers Affected by EvanKelly on Friday April 26, 2013 @07:08PM (#5616028)
Maybe I'm misunderstanding (entirely possible!) and I think your point still stands, but isn't it 50M * 1,000 hashes * # of possible salts?

EDIT: Just realized that the salts have to be stored somewhere and the attacker probably grabbed those as well. I think that answers my question.

[ Parent | on HN ]
Re:LivingSocial Hacked – 50 Million Customers Affected by mpyne on Friday April 26, 2013 @07:12PM (#5616040)
No, because the salt is stored with the password. Salts are used to defend against reversing a password hash into a password, but they don't appreciably impede bruteforcing passwords into hashes.
[ Parent | on HN ]
Re:LivingSocial Hacked – 50 Million Customers Affected by nwh on Friday April 26, 2013 @09:18PM (#5616407)
It does mean that for a large dictionary attack things will go a lot slower. Rather than one computing one hash and comparing it to 50M hashes, the same word must be hashed with 50M different salts and then compared with their respective hashes.
[ Parent | on HN ]
Re:LivingSocial Hacked – 50 Million Customers Affected by hexonexxon on Saturday April 27, 2013 @02:23PM (#5618580)
You can rent miners on the bitcoin network to use their pooled hashrate to break passwords, same with moxie's service cloudcracker.com
[ Parent | on HN ]
Re:LivingSocial Hacked – 50 Million Customers Affected by mpyne on Friday April 26, 2013 @10:12PM (#5616522)
That's a more specific way of phrasing reversing the hash into a password, yes. ;)
[ Parent | on HN ]
Re:LivingSocial Hacked – 50 Million Customers Affected by rmc on Sunday April 28, 2013 @02:29PM (#5622180)
Salts are used to make rainbow tables useless.
[ Parent | on HN ]