On: Disqus cracked – Security flaw reveals users’ e-ma...

[Jakob]

The rainbow table would just need to include alphanumeric letters + '@' for up to 30 letters. I think your emails are in nearly every rainbow table in existence.

[aparadja → Jakob]

Just the 1-10 character lowercase alphanumeric rainbow table from freerainbowtables.com is 297 GB. Of course, you can generate rainbow tables with various parameters and tradeoffs so it's not trivial to compare them.

Still, I don't think I've ever had a rainbow table that contained plaintexts longer than 12 characters. Are 30+ length tables common these days?

[Jakob → aparadja]

EDIT: “nearly any email rainbow table”, i.e. 1-10 characters cross joined with all domains for a given tld.

You’re correct that brute force with an entropy of 3 per bit would still be too big for rainbow table usage (like 10^15 PB too big).

[darkarmani → aparadja]

Using MD5 means that CPU/GPU is cheaper/easier than a rainbow table. Or you can use both. Generate 33.1B hashes/s and start with a rainbow table.