phpass HAVE BEEN CRACKED! What is the solution?

[eluser]dmorin[/eluser]

Thus, I think a strong randomly-generated static salt string in your code is good enough for the situation that the hacker gets away with the database and not your code. However, I do see that a random salt would slow the hacker down significantly in the situation that the hacker got code and data. I guess it comes down to how long it takes to hash an entire dictionary of weak passwords.

I think you're underestimating how effective per row salts really are. Generating rainbow tables takes a good amount of time but even more importantly they are large. I have 8GB rainbow tables that I consider of medium to small size. So say I need to generate rainbow tables for 100k users, that alone would take months if not years to do, and would be 781 Terabytes in size. How many crackers do you know with access to more than three quarters of a petabyte of storage! Compare that to generating a single rainbow table for all accounts and it's a huge difference.

I highly recommend this for authentication overviews: http://stackoverflow.com/questions/549/t...eta#477578

and this for people interested in login cookies: http://www.cse.msu.edu/~alexliu/publicat...cookie.pdf