Re: md5 again

Vince Vielhaber <vev@michvhf.com> writes:
> Simple dictionary passwords.  Run them thru a script and compare the 
> output.  

I was under the impression we'd prevented that by use of a random salt
chosen on-the-fly for each login attempt ... have to go reread the
thread to be sure though.

In any case, if your threat model is a dictionary attack, what's to
stop the attacker from using a dictionary of likely usernames as well?
I still don't see much security gain from hashing the username.
        regards, tom lane