彩虹桌攻击是否构成威胁？
让我们假设一个简单的非加盐哈希函数，只是一个普通的旧$hash = md5($pass)。
前提：
- 密码哈希全部发生在服务器端，并且哈希值存储在数据库中。客户端没有办法看到这些。
- 彩虹表攻击必须了解哈希值才能检索密码。
鉴于前提 2.，这意味着黑客已经控制了数据库，此时您面临着更大的问题。
因此，尝试阻止彩虹表攻击的目的只是为了保护从已经受损的数据库/系统检索密码。是那么简单还是我还缺少其他东西。
我已经熟悉密码哈希技术，但我只是想知道为什么对彩虹表有如此多的炒作。谢谢！
let's just assume a simple non salted hash function, just a plain old $hash = md5($pass).
Premises:
- the password hashing all takes place server side, and the hashes are stored in the database. The client has no way to see these.
- a rainbow table attack must have knowledge of the hashes in order to retrieve passwords.
Given premise 2., that would mean that the hacker already has control of the database, in which point you have a much bigger problem on your hand.
So, is the point of trying to foil a rainbow table attack simply to protect the retrieval of passwords from an already compromised database/system. Is it that simple or is there something else that I am missing.
I'm already familiar with password hashing techniques, but am just wondering why there is so much hype about rainbow tables. Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
是的。
许多人对所有事情都使用相同的密码。泄露原始密码（而不是简单地将其更改为您知道的密码）通常会使攻击者能够访问某人在其他服务上的帐户。
与字典攻击（需要散列）或暴力破解（需要更多散列）相比，彩虹表的计算强度（简单查找）也少得多。
使用强而独特的密码！
Yes.
Many people use the same password for everything. Compromising the original password (as opposed to simply changing it to something you know) can often give an attacker access to someone's accounts on other services.
Rainbow tables are also much less computationally intensive (simple lookup) than a dictionary attack (which requires hashing) or brute force (which requires a lot more hashing).
Use strong, unique passwords!
大多数时候，从数据库窃取数据是通过注入成功的。有时甚至盲目注射。
在您的某个脚本中发现数据库注入漏洞的攻击者不会获得对系统其余部分的任何控制权，直到他能够检索某种更高级别的凭据（可能是管理员的密码）。
如果您（作为管理员）将密码与其他用户一起存储为简单的 md5() 哈希值，并且攻击者设法检索它 - 他最终可以通过使用彩虹表来查找它来超越您的系统。
Most of the time, data-theft from databases succeed through injection; sometimes even blind injection.
An attacker who has found a database injection exploit in one of your scripts doesn't gather any control over the rest of the system until he is able to retrieve some kind of higher credential - which could be the admin's password.
If you (being the admin) have your password stored as a simple md5() hash together with the rest of the users, and the attacker manages to retrieve it - he could eventually overtake your system by using a rainbow table to look it up.
如果我理解正确的话，彩虹表消除了计算哈希值的计算负担（故意很高），因此攻击速度更快。
If I understand them correctly, rainbow tables remove the computational burden of calculating the hashes (which is deliberately high), so attacking is faster.