Re:Enough with the Salts: Updates on Secure Password Schemes
by shadowfiend on Wednesday April 01, 2015 @01:00PM
(#9305051)
Computing the hash of a known password is trivial, though—once you know one user used Passw0rd$, it's easy to check every user for that password, even if you have a salt, because the salt is not hidden. So you're just running n password checks in the number of users—admittedly, this is still n checks, but the difficulty of that pales in comparison to brute forcing passwords, and while it's strictly slower than just checking “is anyone else using exactly this”, it's not that much slower in the larger scheme of breaking a set of passwords.
At least that's my understanding... I am not a security expert! :)
Re:Enough with the Salts: Updates on Secure Password Schemes
by icebraining on Wednesday April 01, 2015 @01:05PM
(#9305095)
Checking every user for a specific password is equivalent to a dictionary attack, using a single word. In fact, commonly found passwords from previous leaks are usually incorporated in such dictionaries.
Re:Enough with the Salts: Updates on Secure Password Schemes
by mdavidn on Wednesday April 01, 2015 @02:47PM
(#9305875)
That's a fair point, but an unsalted hash gives an adversary information before they brute force any password.
In the "user with multiple accounts but one strong password" scenario, for instance, grouping by password would highlight which users are inclined to use the same strong password with multiple accounts, perhaps on other web sites. Multiple accounts would give an adversary more identifiers to use when cross-referencing other leaked databases or the web.
Re:Enough with the Salts: Updates on Secure Password Schemes
by nathanaldensr on Wednesday April 01, 2015 @01:08PM
(#9305124)
I think this is why one is supposed to use random salts per password. That way, you can't use the successfully-guessed password's hash to assume other passwords with the same hash represent the same clear-text password.
Some subset of your users will inevitably use the same terrible password as another user. Or one user will create multiple accounts using the same strong password. These passwords should appear unique in storage.
You still need salt, and that salt must be unique for each password. That's the peril of PBKDF2 password storage: I've seen applications completely botch salting by using one for all users. Bcrypt and scrypt avoid this common error by salting internally.