Say there is only a single hashed password in the passwords file.
If it was salted, would that make it more secure?
My logic is:
Yes because SALT helps protect against rainbow tables and dictionary attacks. Which would make it more secure?
Absolutely. If no salt is used, then a precalculated set of tables, called rainbow table, can be used to determine the plaintext of the password. With salt, a brute force process of calculating every possible value till the hash is matched is the only way to find the password.
answered Nov 13 '15 at 3:47
-
Technically in what way does it protect against an attack with a rainbow table? It does only make the password longer, but that is not really a protection against a precalculated rainbow table, just a requirement for a rainbow table calculated for longer strings. I don't understand this statement. – techraf Nov 13 '15 at 7:27
-
3@techraf - because nobody calculates rainbow tables for anything the size of a typical salt. Random 8-character alpha-numeric passwords would take 24 terabytes (without the resulting hash!), and salts are usually longer still. You could calculate a table for a single salt, but it would only be useful once, essentially, and since you'd get the salt at the same time as the password, building the rainbow table would be equivalent to cracking the hash. – Clockwork-Muse Nov 13 '15 at 11:11
