5

tl/dr: Even if your arguments were correct, building a rainbow table for a single password for all possible salts is practically impossible. With a 128 bit salt and a 184 bit digest (bcrypt), building such a rainbow table for even a single password, and then storing it on high density Micro SD cards, would require a stack of Micro SD card weighing almost as ...


3

I have read that it's not enough to hash a salted password once. You need to keep hashing it thousands of times to make brute forcing more difficult for attackers. That is right. You want your password hash function to be slow, so that an offline brute-force attack would also be slow. hash = hashManager.ComputeHash(hash); You really want to use the ...


3

WinRAR does not check a password at all. It passes a password through the hash function to set a 128/256 Bit AES encryption key and then uses this key to encrypt the file data valid until RAR 4.x format. The new RAR 5.x format detects wrong passwords even before starting extraction and does not extract garbage. RAR 5.x stores a special password hash ...


1

You can use IP-based rate-limit, even if the attacker can control multiple IP addresses. For you, keeping track of tens of thousands of IP addresses is easy: just create a database table with IP address, account accessed, and number of authentication errors. If they are above a threshold, slow down the response. Simply sleeping for, for example, 1 second ...


1

No, it won't work. Because of one key factor: probability. If you throw probability into any system, there's no guarantee that the other side is real, or not. Like you cannot say with certainty that a dice is fair or not by throwing it a few times. You can say that probably the dice is fair after lots of throws. You only have a probability, as you already ...


Only top voted, non community-wiki answers of a minimum length are eligible