Hacker News new | past | comments | ask | show | jobs | submit login

Fast cryptographic hashes like SHA-1/2 are heavily discouraged for password storage (even with a salt). As they are very easy to implement in parallel.

Yes salting prevents as effective brute forcing. Yet modern computing 8 char passwords + salt can be exhausted within 24-48 hours (on a <$20k GPU cluster) if you using SHA-1/2 + salt.

bcrypt/scrypt/PBKDF2 are much harder to brute force (by design) and circumvent this weakness.




Tangent:

Salts do zero to mitigate brute-force attacks.

Salts defend against one idiosyncratic lookup-table attack that was briefly popular in the early 2000s because of a widely-deployed password hash function that, unlike every password hash since the mid-1970s, didn't randomize. This is the attack to which "rainbow tables" are applied.

If you're considering rainbow tables as part of your threat model, you're already so boned that you should give up and just use a real password hash. If you're not considering rainbow tables, you don't have to consider salts.

The only good thing about "strong salts" is that they function as a kind of shibboleth so you can tell if people understand what problems they're contending with when storing passwords.


> "every password hash since the mid-1970s"

Back then systems used no password at all or stored it in plain text.

In the mid-1970s the NSA just finished DES.

Password shadowing first appeared in UNIX systems with the development of System V Release 3.2 in 1988 - see: http://en.wikipedia.org/wiki/Passwd#History

> "briefly popular in the early 2000s"

Til the dot-com-bubble timeframe many websites stored plain text passwords in databases, later they shifted to SHA1/MD5 hashed passwords without salt.

Only with the Sony hacks a few years ago, many added some kind of salting.


The original Unix crypt function was, IIRC, salted.

To head off an unproductive discussion, I'll just repeat:

* salts do zero to mitigate brute-force attacks

* even trivial salt schemes break table-based attacks

* the overwhelming majority of passwords are cracked through brute-force, which is attack vector that real-world password hashes need to be evaluated on.


Salts can mitigate brute-force attacks in the specific case that the salt is stored separately from the hash (and only one is leaked).


The job of a password hash is to strengthen weak secrets in compromised databases. Your suggestion defines the problem away: "never lose the whole database", it suggests, "and you don't have a problem".


Insofar as I have seen, the salt is stored right next to the hash, so how do you get one and not the other?


^ THIS!

If anyone wants to claim that salts do anything to stop brute-force attacks, take a sample of your passwords and run it through FL Cracker:

https://scott.arciszewski.me/public/FL-Cracker.txt




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: