A developer stores user passwords using MD5 without salt. A data breach occurs. How does an attacker most efficiently crack these passwords, and why is salting specifically important?
- A.The attacker brute-forces each hash individually using a dictionary attack
- B.The attacker reverses the MD5 hash mathematically to recover the password
- C.The attacker uses a precomputed rainbow table: a lookup table mapping hash values to their plaintext inputs. Without a salt, identical passwords produce identical hashes, allowing one lookup to crack all accounts with the same password. A unique salt per user makes precomputed tables infeasible by ensuring the same password produces different hashes for each user
- D.The attacker needs the salt to crack passwords, making salted hashes easier to break
Why C is correct