Quote from: sturle on June 28, 2011, 05:39:32 PM

Quote from: tsvekric on June 28, 2011, 05:30:37 PM

And the uncracked password list that was released had the salts along with each password, so being 'salted' or 'unsalted' shouldn't matter...

Yes, it matters. A lot. Salted means you have to crack each password individually. You have to run through the entire list of candidates (until a match) for each and every salted password (given unique salts). With unsalted passwords you can run through the wordlist once, and get all matching passwords with a single MD5 run for each word in your wordlist. It doesn't matter for one single password, but for 60000 salting means 60000 times more work. And salting renders rainbow tables useless, because you'd have to build one rainbow table for each possible salt.

But the salts are given. Correct me if I'm wrong, I'm new to understanding this: a password hash here is given as salt*md5*password sort of setup. If it was just md5*password, you can solve the md5 and then just run that through the list of hashes to get all the passwords? But if the salts are given then password crackers aren't trying to figure out the [salt] part of the equation, so you can effectively remove that and it just becomes md5*password again. Right?

like if you have:
[salt1]*md5*[password1]
[salt2]*md5*[password2]
etc... its really hard to solve because you have crack each individual salt - BUT you don't have to crack each individual md5. If the salts are listed right there on the table (and on MtGox that's what happened) then you're not cracking salts, just the md5 again. That's how they get all these super-complex passwords - right? They solved one simple md5 pass, and then used the given salts to get any password instantly. Or am I not understanding how this works....