Re:A mode for password hashing
by protonfish on Tuesday November 18, 2014 @10:24AM
(#8624188)
This sounds like a good idea at first even though it does have the side-effect of creating a lot of orphan password hashes in your table. Let's step into the shoes of a criminal that has access to your database and hashing algorithm and see if it makes his life that much more difficult.
The first thing he would do is a dictionary attack from a list of common passwords: Pick one user, create the hash and search the hash table for a match. That is one step more than only having to check the hash in the same row. I'd say it is slightly, but not significantly, more difficult.
The first thing he would do is a dictionary attack from a list of common passwords: Pick one user, create the hash and search the hash table for a match. That is one step more than only having to check the hash in the same row. I'd say it is slightly, but not significantly, more difficult.