0

Context: When the Twitch whole code repository was leaked, it created multiple discussions on social medias. And one day I was on Reddit and said that the leak of the hashing algorithm and the salt would possibly put ALL of the website accounts in danger if the leaker also had acesss to the database with the hashed passwords. One guy told me that "it would do nothing, since most it would be impossible to decrypt even in this condition" and "trust him because he studied cybersecurity".

Still after some years this has been bugging me, what he said was true? If yes, how could it still be safe with the fact that the hashing algorithm would heavily help on decrypting a viable password?

2
  • Welcome to the community. Please refer to the Kerckhoff's principle, which states that a "secure" system is where even the hashing is leaked the data is still secure (I am paraphrasing) Mar 14 at 19:23
  • Password hashing is used to prevent password disclosure in such cases as you describe. Salt doesn't need to be secret. The only requirement for salt is that it should not be reused,
    – mentallurg
    Mar 14 at 20:24

2 Answers 2

3

Algorithms used by web sites for salting and hashing passwords are generally not secret. For example, the algorithm used by Argon2 (which is a modern function for salting and hashing passwords) can be found on Wikipedia here.

This is in the philosophy of Kerckhoffs's Principle, which holds that a cryptosystem should be secure, even if the algorithm is known.

The very reason that web sites salt and hash passwords (using a function designed for this purpose, such as Argon2, or the older PBKDF2 function) is to mitigate the attack that you describe in your question. If a site uses best practices for salting and hashing passwords, then even if an attacker were to gain access to the salted and hashed passwords, it would still be difficult for the attacker to derive the underlying passwords - even though the algorithms used for salting and hashing are known.

1
  • 1
    "Secure algorithms for salting and hashing..."
    – schroeder
    Mar 15 at 12:45
1

The normal case has been answered by @mti2935.

I would like to add that it depends a bit on the hashing algorithm that was used. If the code leak shows that an insecure hashing algorithm with weak settings was used, then, yes, it poses a serious risk.

Knowing the hashing algorithm will also save time in dictionary attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .