Quote:
Originally Posted by oo_jazz_oo
Is it really necessary to add the salt onto the password, even when the password is hashed?
Since your storing the salt in the database anyways, if the database was compromised, they would be able to see the salt, then just take that away from the password and have the hashed password anyways.
I'm not arguing that you shouldn't use it, i'm asking why use it.
Edit: Nvm, I didn't notice you were using the salt inside the md5() hash...
However, I still dont see how this would make the login any more secure, since the salt is automatically added to the password on login attempt.
If you were trying random passwords, you would still only need to know the single password, and the salt would be added...
At least on say, a website, how would this add security? Since if a system was trying random password to break in, it wouldn't need to know the salt anyways...
|
Salts don't protect against brute force, they protect against rainbow tables. Salts are only useful after the database has been compromised (imagine there's a SQL injection vulnerability in your website and somebody gets a copy of your users table; even if they had the code that generated the hashes, they'd have virtually no way of recovering the passwords since rainbow tables are impractical).
Quote:
|
Originally Posted by Wikipedia
The benefit provided by using a salted password is making a lookup table assisted dictionary attack against the stored values impractical, provided the salt is large enough. That is, an attacker would not be able to create a precomputed lookup table (i.e. a rainbow table) of hashed values (password + salt), because it would take too much space. A simple dictionary attack is still very possible, although much slower since it cannot be precomputed.
|
Rainbow tables get very large as the length of the original phrase (salt + password + salt) increases. An MD5 rainbow table that contains all alphanumeric inputs that are 1-8 characters is 160 GB. One with inputs 1-10 alphanumeric is 396 GB; this is the largest I could easily find online. If the salt is 10 characters, and the password is 8, that's a 28 character input. That would be one huge database.
(it's worth nothing that MD5 or SHA1 and other fast algorithms aren't recommended for password storage in the real world)