Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Shouldn’t the hash be salted and useless elsewhere?


In theory, it should. In practice? Who knows.


In practice it'll be plaintext stored on someones hard drive.


Outside of the same authentication domain with bad auth token practices (windows) the hash almost always is useless elsewhere. Salting increases the complexity and thus size of hash tables or hash comparison (rainbow tables), but if your manage to break or brute force the entries, salted or not, the secret often is reused by many users.


Provided that its hashed with salt / diff methods, sure - but how can you be sure?


That's not what salting does, and different hashing methods are irrelevant. The danger of having your hash leaked is that it can be cracked and the plaintext password recovered. The hash itself is entirely useless for logging into other services.


t. infoseclet


It can still be cracked


This is the SHA 256 of a phrase... go for it!

7BB7DB877943832837046863EF45C252D3A08C92A273F7B665210A6E12701095


A phrase almost certainly has a lot more entropy than the layman's reused password from other leaks.


If this is a phrase to unlock a bitcoin account with 1000 bitcoins in it, then you can easily convince people to try and brute force it.

Do you have Amouranth's or xQcOW's salted hash from this leak? Might be worth trying to brute force it.

You try on those kinds of accounts because they might have re-used it or the password might be patterned or not completely random, which gives you a chance that the credential might give you access elsewhere.


good luck hacking my password horse correct battery staple




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: