[wpietri]

Doesn't that depend on the size of the salt?

[jedberg]

To an extent, but there are easy ways to cut the search space. For example, you could make a unique request with garbage on it from a known IP every day, and then all you have to do is build a rainbow table for that one IP to find out what the salt is for each day, and then you can fully reconstruct the logs.

[mattlondon]

If the salt is a random 64bit number (for example) then "finding out" the salt is not trivial.

[wpietri]

And unless I'm missing something, it seems easy to add plenty of bits to the salt until it's no longer practical to reverse.

[YetAnotherNick]

@mattlondon: The salt is known to plausible, that is the only way someone can hash it.