I’m not willing to panic just yet…
Rainbow tables need to be big. A lot bigger than indicated in the article actually.
Ok, it may take just a couple of cents to calculate the hashes for 5 billion addresses, but that’s starting from the point where you already know all the addresses in use. I’m guessing: you don’t.
A rainbow table for all email addresses should cover all possible combinations of characters, digits, special characters,… (about 40 possible characters per position in the address) into email addresses and then calculate all the hashes for these combinations.
To illustrate: if someone used up 30 characters to make the not-so-crazy emailaddres "example.name01@something.co.uk" and we want to make sure we have the hash for that address in our rainbow table, our table needs to have all possible combinations of 30-character addresses. That would make our table 40^30 entries big… (and I admit it could be smaller since you can eliminate a lot of combinations because they would be obviously malformed as email addresses, but just computing the hash is faster than checking if it’s a possibly valid address)
Now, I don’t know exactly how big that number is, but I have a gut feeling it’s more than 5 billion…
