An attacker gets a list of hashed passwords. How does he know when he has cracked the password(s)? He can't try millions of times on the comprised account.
Attacker gets hashed password. How does he know that "pAssword" is the correct password and not "passwoRd"?
I'm so missing something basic. Let me make certain I understand it:
- The DBA takes my great password (pa$$word) and hashes it.
- Attacker gets list of passwords.
- Attacker tries "password." It gets hashed. He sees that hash-of-password does not equal my password. 3a. He tries hash-of-pa$$word. It gets hashed and he sees that the two are equal. Therefore he cracked my password.
- After a while (x amount of time) he has cracked (say) 90% of the passwords and then stops because of diminishing returns. (Unless he really wants MY password.)