Vince Vielhaber <vev(at)michvhf(dot)com> writes:
> Simple dictionary passwords. Run them thru a script and compare the
> output.
I was under the impression we'd prevented that by use of a random salt
chosen on-the-fly for each login attempt ... have to go reread the
thread to be sure though.
In any case, if your threat model is a dictionary attack, what's to
stop the attacker from using a dictionary of likely usernames as well?
I still don't see much security gain from hashing the username.
regards, tom lane