What is a common countermeasure against rainbow table attacks?

Question

Options

• AImplementing account lockout policies
• BUsing salted hashes
• CDisabling guest accounts
• DEnforcing password complexity requirements

• A
  4% (1)
• B
  92% (23)
• C
  4% (1)

Explanation

Salted hashes (B) defeat rainbow tables by appending a unique random value (the salt) to each password before hashing, ensuring that even identical passwords produce completely different hash outputs - rendering precomputed hash lookup tables useless.

• A (Account lockout) prevents brute-force online login attempts, not offline rainbow table lookups against a stolen hash database.
• C (Disabling guest accounts) reduces attack surface but has nothing to do with how passwords are stored or hashed.
• D (Password complexity) makes passwords harder to guess but doesn't stop a rainbow table from containing a hash for a complex password if it was precomputed.

Memory tip: Think of salt like seasoning - just as adding a unique spice to each dish means no two taste the same, a unique salt per password ensures no two hashes match, even for identical passwords, making precomputed tables worthless.

No community discussion yet for this question.