Quote:
Originally Posted by jbjb
I've just reread this, and don't get the point you're trying to make. If you've got hold of the passwd file, or whatever, with the salted hashes, you already know all the salts - they're sitting right there in plain text. What would knowing the salt generation algorithm gain you? (Genuine question!)
|
Unix password files are well-documented, but any given site like mobileread can do things differently, so an attacker would need to identify that in order to generate usable hash tables. Or to identify a more efficient attack if one exists.