How can rainbow tables be defeated?

Question

Options

• AUse of non-dictionary words
• BAll uppercase character passwords
• CPassword salting
• DLockout accounts under brute force password cracking attempts

• A
  5% (3)
• B
  2% (1)
• C
  91% (60)
• D
  3% (2)

Explanation

Password salting directly defeats rainbow tables by appending or prepending a unique random value (the "salt") to each password before hashing it. This means that even if two users have identical passwords, their stored hashes will be completely different, rendering precomputed rainbow table lookups useless - the attacker would need to rebuild an entirely new table for every unique salt.

Why the distractors are wrong:

• A (Non-dictionary words): This helps against dictionary attacks, not rainbow tables, which work against any precomputed hash regardless of word complexity.
• B (All uppercase): Reducing character variety actually weakens passwords; rainbow tables can be built for any character set, including all-uppercase combinations.
• D (Account lockout): This counters online brute force attacks where guesses are submitted live; rainbow tables are an offline attack on stolen hash databases, so lockouts offer no protection.

Memory tip: Think of a "salt" like seasoning food - just as adding a unique spice to identical dishes makes each taste different, adding a unique salt to identical passwords makes each hash different, spoiling any precomputed "recipe" (rainbow table) an attacker might use.

No community discussion yet for this question.