Quote:
Originally Posted by ratinox
Unix password files are well-documented, but any given site like mobileread can do things differently, so an attacker would need to identify that in order to generate usable hash tables. Or to identify a more efficient attack if one exists.
|
That's true, but in most real-world implementations I'm aware of (admittedly, most of which are at the more secure end in terms of requirements) the hashes are not generated solely by an algorithm, but use local (unreproducible) entropy.