It would be rather susceptible to a brute force attack. Imagine that someone sniffs your network traffic pulling out username/password combinations and storing them on a separate machine. That machine then whiles it time away doing a dictionary attack attempting various strings and various salts to generate the same signature of the crypt'd password. (The implementation of this could be made very efficient: it could be a hashtable of crypted password => username, then for each candidate password/salt generated by the cracking programming all that would be required is a key lookup to retrieve the username). You (the webmaster) wouldn't have any idea it was doing it, since it wouldn't be taking up your network resources trying different passwords against your website, and given a decently large sample of passwords, they'd probably find a weak one with ease.
In reply to Re: Re: Invisible Cookies
by djantzen
in thread Invisible Cookies
by Anonymous Monk
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |