Re:Can Snowden be targeted using the Adobe breach?
by aw3c2 on Saturday November 02, 2013 @07:34AM
(#6658886)
Ah, I did not know that. And I wrote some password hashing with a global salt myself. So I stand by my comment with "one laughing and one crying eye". I thought salts were mostly against precomputed rainbow tables for specific hash functions, but of course if my hashes are valuable enough, a global salt makes cracking them easier than if I used a random/unique one per hash.
[ Parent
| on HN ]
Re:Can Snowden be targeted using the Adobe breach?
by sillysaurus2 on Saturday November 02, 2013 @08:11AM
(#6658955)
This is why programmers should stop trying to write their own password systems.
Re:Can Snowden be targeted using the Adobe breach?
by amenod on Saturday November 02, 2013 @09:38AM
(#6659131)
To be exact, programmers should stop using their own password systems (unless - well, let's not go there :).
Writing them is actually an excellent exercise, and humbling one too. Especially if you show your code to some skilled hacker / security expert.
Re:Can Snowden be targeted using the Adobe breach?
by jtheory on Sunday November 03, 2013 @10:54AM
(#6663555)
From what I understand rainbow tables are not really used anymore -- they were useful when it took longer to calculate hashes, but nowadays you just need a decent graphics card to calculate a few billion hashes (MD5 or SHA1) PER SECOND.
Per-hash salts don't really slow that down at all, unfortunately.
Short-version: don't use the hash algorithms that are designed to be fast for protecting sensitive data; use something solid with a work factor instead.