Exactly... It's actually a pretty good defense...
If i follow the logic, the encryption key of the wallet file is sha256(salt2.sha256(salt1.password).nickname).
It'll become virtually impossible for an attacker to use a rainbow table using this scheme, and the resulting 256 bit encryption key they use with AES-256-CTR is pretty good if i'm not mistaking
If i follow the logic, the encryption key of the wallet file is sha256(salt2.sha256(salt1.password).nickname).
It'll become virtually impossible for an attacker to use a rainbow table using this scheme, and the resulting 256 bit encryption key they use with AES-256-CTR is pretty good if i'm not mistaking
Without knowing how they choose/generate salt value for hashing, i can't say it's "pretty good defense" (even though it's far better than we initially think).
If they choose/generate salt value poorly, then attacker could find out the salt value easily and then they just need to brute-force all password combination. AES-256-CTR is still easy to brute-forced according to https://www.cryptopp.com/benchmarks.html and https://www.sisoftware.co.uk/q-a-benchmarks-cpu-vs-gpgpu-cryptographic-performance/.
But in the end, it doesn't matter since the software is closed-source and there's no way to verify it.
