New answers tagged

5

Gaining read-only access is a much more likely scenario than write access - after all, read access to an old backup or test server somewhere is nearly as good as read access to the real server. (since people don't change their passwords often enough) Also though, one account nearly anywhere (unless you're a banking site) isn't that valuable. Hundreds of ...


2

While using a sufficiently long and random salt will prevent a precalculation attack (eg: rainbow tables), it will not protect against a simple dictionary attack on the password. Consider the scenario where an attacker gets a copy of the database. If the passwords are just salted SHA2, it may be worth their effort to go after some number of the passwords. ...



Top 50 recent answers are included