Password re-use by another person or on another service How does having the same password in different services make it less secure? How does having the same password as someone else make it less secure? Very basic question that I've always wondered about; I've been reminded by GitHub recently seen this message,


  The password you provided has been reported as compromised due to re-use of that password on another service by you or someone else.


and,


  Generate a unique password for GitHub. If you use your GitHub password elsewhere and that service is compromised, then attackers or other malicious actors could use that information to access your GitHub account.


Theoretically, how would that work? Shouldn't a different salt render it almost useless to any attacker?


  different salt values will create completely different hashed values, even when the plaintext passwords are exactly the same [Wikipedia]
Salt is usually stored along with the hashed password. When an attacker knows that your password is "abc123" in "pqr.com", he can try your username and password "abc123" in site "efg.com". Now "efg.com", would retrieve the stored hash against your username and extract the salt from it. Then the extracted salt is used to calculate the hash of the entered password and then matched with the stored hash.

The purpose of salt is to ensure that just by looking at two hashed passwords, the attacker can't tell whether they are same or not.

Salt is not a secret. The only requirement is, it has to be unique within a given DB. Its existence is just for preventing the attacker to prepare a pre-computed lookup table with passwords and their hashes to do a dictionary attack. But if the password itself is known to the attacker, salt cannot save the user.