Re: Hashing passwords

[Ansgar Wiechers <bugtraq () planetcobalt net>]

On 2012-06-11 haZard0us wrote:
> This may well be a silly question but, with this recent hashed
> password leakage, I want to ask something about properly hashing.
>
> The "manuals" say that we should create a salt and then hash it. But,
> since calculating an hash is a "relative simple" operation (in matter
> of processing power), is hashing two or three times the password (hash
> over hash) a "kind of" secure method or it is as weak as not using
> salt at all?
>
> It can still be cracked but...

Yes, it can still be cracked. However, salting passwords defeats the
advantages gained from using rainbow tables, so cracking the password
will still take a significantly longer time than it would for an
unsalted password.

Regards
Ansgar Wiechers
-- 
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------