This post originated from an RSS feed registered with .NET Buzz by James Avery. Original Post: Password Hashing Feed Title: .Avery Blog Feed URL: /blog/Install/BlogNotConfiguredError.aspx Feed Description: .NET and everything nice Latest .NET Buzz Posts Latest .NET Buzz Posts by James Avery Latest Posts From .Avery Blog

This site was mentioned on the latest DotNetRocks and it is a good reminder that hashing a password is not enough.

This site basically created all the possible hashes for 8 letter passwords using [a-b][0-9], so you can send it a hash and it will return the password for you. It even possible to do this for larger hashes (they would need to create much larger tables), but if you throw in a strong salt this becomes practically impossible. (because a good salt is a set of random bytes, exponentially increasing the difficulty of using this sort of method to find the password)

This article contains a decent explanation of how to add a salt to your hashed password , I have been meaning to write something up on how to best do this... but I have not gotten around to it yet.

-James