Salting passwords helps protect against which type of attack?

• A. Defeats precomputed rainbow table attacks.
• B. Eliminates need for hashing.
• C. Makes passwords longer.
• D. Guarantees no brute force success.

Answer: (A)

Salting passwords adds random data to each password before hashing, so the hash becomes password+salt. Rainbow tables are precomputed lists of password-hash pairs built for a specific, fixed hash input. When every password is salted with a unique value, those precomputed tables no longer match, because the same password produces a different hash with different salts. To crack salted hashes, an attacker would have to generate new rainbow tables for each possible salt, which is impractical, making rainbow-table attacks ineffective.

Hashing is still needed; the salt is not a replacement for hashing and does not remove the need to hash passwords. The salt also doesn’t make passwords themselves longer in a meaningful way for security purposes; it’s extra data stored alongside the hash, while the actual password length remains unchanged. Finally, salting does not guarantee that brute-force attempts will fail; it raises the work factor by requiring per-user computations, but determined attackers can still brute-force given enough time and resources.