RainLoop Webmail: Simple, modern and fast web-based email client

Re:RainLoop Webmail: Simple, modern and fast web-based email... by jnbiche on Tuesday June 24, 2014 @10:04PM (#7941867)

I don't really know PHP, but what's the problem? A salt doesn't have to be perfectly random. It just should be unlike any other salt in use.

This looks like it would meet that requirement.

Edit: Since this is HN, I feel obliged to point out that there is a small vulnerability introduced by using a non-CSPRNG here. If an attacker is already surveiling you, and is able to perfectly deduce the state of your PRNG before you generate your salt, and the attacker plans to steal your db at some point in the future, he can get a head start in generating rainbow tables against your database.

But the main value of a salt is in being globally unique, which this is.

[ Parent | on HN ]

Re:RainLoop Webmail: Simple, modern and fast web-based email... by chacham15 on Wednesday June 25, 2014 @02:56AM (#7942618)

>he can get a head start in generating rainbow tables against your database.

While it is true that he can get a head start, a head start is quite useless because the work necessary to reverse one hash is independent of the work necessary to reverse a different hash. That means that you still have to brute force each password individually.

[ Parent | on HN ]