Post
Topic
Board Bitcoin Discussion
Re: It's Official Mt.Gox Database Leaked :(
by
bullox
on 19/06/2011, 21:15:49 UTC
However, if the salt has been exposed then it's the same thing as not using one...  

That's not how salts work. The point is that an attacker can do a lot of effort in advance to generate a massive rainbow table containing the hashes of a large set of possible passwords (or in practice, simply pay for access to such a service).

By adding a random nonce (i.e. the salt) to passwords before hashing them, you force the attacker to include all possible nonce values in those passwords. For each extra bit in the nonce, you double the size the rainbow table, quickly making it infeasible to generate one.

So even if the salt is public, it will still do its job in preventing the use of rainbow tables. The attacker will be forced to brute-force by trying all possible passwords in combination with a given nonce just to crack a single password hash.

And the avergae bitcoin enthusiast has a plethora of brute force power available to them.   Wink   Sorry everyone who used mtgox but you should really be not on this forum and out changing pw at every single site that you have ever used even 1 of the items in that database (username, email, or password)