phpass HAVE BEEN CRACKED! What is the solution?

[eluser]n0xie[/eluser]
This is why you randomly salt your hashes. (yes randomly, not via a encryption key I see some of the 'auth' libraries do)

Even if you expose your whole user table to the outside world, an attacker would have to build an unique rainbow table for each row, making it a lot less attractive. Anyway, rainbow tables are not really the issue. It's the hashing algorithms that are at 'fault'. I suggest anyone really interested in the subject read this even if it's just for this memorable quote:

There are three big differences between Provos-Mazieres and PHK’s scheme:

1. Bcrypt was invented by two smart guys and PHK’s was only invented by one smart guy. That’s literally twice the smart.