Let's suppose I know a website is using BCrypt with salts and the default round of 10. Can I do a dictionary attack by hashing all the words using BCrypt with the same parameters?
1 Answer
Yes, you can. bcrypt, (and other similarly slow password hashing functions) aren't designed to make this impossible, but only to make it prohibitively expensive. Weak passwords are still susceptible to being discovered, but the amount of work an attacker needs to do goes up substantially, and compared to a fast hashing function, much weaker passwords become infeasible to crack due to the extra work required for each guess.
$2a$10$...
or something similar.