Hacker News Reader

Comment by wapz | Hacker News Reader

> we encourage you to change your password for any other services where you are using the same password

Based on that statement it sure doesn't sound like the PWs were salted (or at least properly salted).

So can someone explain to me why the downvotes? If the salts are unique to the user wouldn't it be nearly impossible for the hacker to use the hashed pw on other sites? (I'm not a web dev but to my understanding that's how it works)

Even if salts are unique to a single user, there's still a possibility where someone determined can get the password.

That's because the user specific salts were probably in the same db. This will make it difficult since a brute force attack must be done for every single password. But it is still not impossible.

> If the salts are unique to the user wouldn't it be nearly impossible for the hacker to use the hashed pw on other sites

Even if the salts aren't unique, can you explain how can they use the hashed password anywhere?

If I give you a hashed password and the salt used, what exactly can you do with it? (apart from brute forcing)

For instance, you can make a list of the top 100,000 passwords, plus another 1000-per-user variations (based on username or email or whatever). Now run them against all users. You'll get some successes, and now those users are at risk.

A password DB breach, salted or not, allows an offline, non-rate-limited, attack on those passwords.

Reply on news.ycombinator.com