I was just reading about how it's better to use bcrypt to protect passwords instead of saving password hashes in databases, and that got me thinking about other aspects that hackers work on that I had never thought of before. Please correct any part of my questions as I have very basic understandings of cryptography and hacking in general. I'm just looking to learn the general aspects of these types of attacks, for myself.
I understand Coda's point in that salting your password wont save you if the attacker is just brute forcing passwords instead of trying to decrypt your hashes using rainbow tables, so we have two different types of attacks:
The hacker has a password file/database but does not have the code/program, or trying to gain access by brute forcing would cause account or IP blockage. In this case, they'd be forced to try and decrypt the password field of let's say the database. If you saved a hash, then they'd just try comparing the hash field to a rainbow table of different types of hashes of different words, right? What would happen if I stored the Hash of the Hash of the password? Are there rainbow tables for that?
On Coda's article, he mentions that you basically can rent computing power for cracking for cheap. Trying out millions of passwords per second. This would obviously be against a file or database I'm guessing, not a live site (unless they hacked the server, got the website code, removed the account locking mechanism and mounted their own environment, would they even try that?). If they are doing this against a password file, does each hacker write their own program who will craft requests to brute force or decrypt said password source?
When they are trying to brute force decrypt a password file, do they try with every possible encryption/hashing method? Or what is the most average or common way?
Thanks in advance for your responses