Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Salting passwords also protects against password attacks using precomputed rainbow tables, but that wasn't a concern back then.

Hmm, if not to defend against rainbow tables... why were the passwords salted back then?



From the article:

One problem with hashed passwords is if two users have the same hash, then you know they have the same password. A solution (invented in Unix) is to hash some random bytes (called salt) along with the password to yield the stored hash. Since different users will have different salt, the hashes will be different even if the passwords are the same. (Of course you need to store the salt along with the hash in order to check passwords.) Like Unix, the Alto used salted and hashed passwords.


Without salts, you can tell if two or more people have the same password, and you can pre-compute a dictionary of common passwords.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: