I've heard about several instances where OSINT researchers were able to match user accounts from multiple data leaks purely based on their hashed passwords, assuming accounts had the same password on different sites. (Yes, even when there were no other identifying characteristics, such as re-used usernames, re-used email addresses, browser fingerprints, or IPs.)
As far as I know, these data leaks all had salted passwords, so the researchers couldn't just compare the plain hashes between leaks.
How did they do it? Would they just try to brute-force both leaks and then compare the plaintext where they got matches? Are there any tricks that can be used to reduce the computational effort? E.g., how feasible is it in practice to pre-compute huge rainbow tables for salted passwords? Doesn't the extra "dimension" make this intractable?
I assume these analyses only succeed with very simple passwords (e.g., <7 characters without special symbols), or when the site admins used some very flawed hashing implementations (e.g., easily predictable salts). True?
PS: Password re-use is bad in any case. Please don't re-use passwords.