Some forms of attacks on passwords use dictionaries. It is safer to use nonsense passwords like YunSUanLin, Artibichoke, etc., which do not seem to pertain to any dictionary?
Big subject. Salt is probably the easiest way thwart dictionary attacks, but there are other vectors like known password lists. Attackers will certainly try all the weak/wounded/compromised passwords on the list.
@jww Yes, but dictionary attacks have nothing to do with pre-computed tables. A dictionary attack is an attack where your password candidates are picked from a list of likely candidates, not any possible within a keyspace (i.e. brute force).
@jww Yes, you generate pre-computed tables from dictionaries, but if you use a table to search if a hash has already been calculated before, then you don't conduct a dictionary attack, you use a lookup attack. These are not the same thing, they are not interchangable.
@MechMK1 - Dictionary attack. I'm not sure a "lookup attack" is mainstream. It has always been called a dictionary attack since I can remember. I'm not citing wikipedia as the authoritative reference. I'm only using wikipedia and owasp as examples that most folks call it a dictionary attack. (Or most folks I know).
@jww I still believe that we have a fundamental disagreement on what a "dictionary attack" consists of, and I would like to use the DMZ to clarify my standpoint more clearly and to gather your standpoint. Because in principle, you're not wrong, but generalized statements like "Salts protect against dictionary attacks" are wrong.
@jww Also, if you look at the OWASP example you cited, on P. 10 you see "Dictionary Attack", "Brute Force Attack" and "(Pre-Computed) Rainbow Table Attack", showing that there is a difference between the two.
@MechMK1 - Yeah, I tried to avoid Rainbow Table Attack. That applies to MD5 and the hash chains due to the design of MD5's compression function. Pre-computing from a dictionary has been around a long time. It is more like a property of the attack. You can precompute the hashes, or you can use the uncooked word and perform the transform on the fly.
By using pre-computation, you (or someone else) perform the "heavy lifting" beforehand. Comparing a found hash with an already existing one is very quick and only requires "looking it up" in the existing hash database.
Hence why I named it a "lookup attack", as compared to a "pre-computation" attack, but it refers to the same thing.
A dictionary attack is more similar to a brute force attack, in the sense that a password candidate is taken, (possibly salted) and hashed, then compared to the desired password.
And here is the crucial difference: A salt does not protect you from a dictionary attack. Not at all.
It protects you from pre-computed tables
And the claim that looking up a hash in a database of pre-computed hashes is identical to using a dictionary (and possibly permutation rules) and computing the hash on the fly is just wrong. They are different attacks, and they have different mitigations.
Discussion between MechMK1 and jww
Discussion between MechMK1 and jww