Post
Topic
Board Bitcoin Discussion
Re: Cracked Passwords List Leaked, were you cracked?
by
finack
on 28/06/2011, 21:41:34 UTC
Or am I not understanding how this works....

Salts prevent people from pre-computing large amounts of hashes and then just simply comparing the hashes to see what the password is. These large lists of pre-computed hashes are called rainbow tables.

Let's imagine you and I both have the same password. If you use an unsalted hash, the resulting hash of the password will always be the same.

user:hashed_password

me:54yg7(momlk32
you:54yg7(momlk32

if I had a rainbow table for that type of hash, it might have an entry like:

54yg7(momlk32:password1

And I'd just have to search for it, not have to do any hashing and I'd find both our passwords out.

On the otherhand, if I use salts with the hash, the result would look more like this:

user:$salt$hash

me:$yg$sdf87dsfgbh^%$szdfds
you:$7z$powiuer9asd3ee343z^%

Practically this prevents me from computing a bunch of hashes beforehand and simply comparing the results to the stored hashes. You and I both still have the same weak password, but since a salt was used they have to be cracked independently.

It's not a big hurdle, but it's something.