583
Uh oh, somebody's not following best practices, that's a paddlin (lemmy.world)
submitted 1 year ago by to c/cybersecuritymemes@lemmy.world
106 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 1 year ago (2 children)

Because

they save the hash for the full password as well as the hash for the password without the last character. So if you attempt to change only the last character, they can detect it.

is not how hashing works. You can't create a subset hash to compare against the set hash.

Let's say my password is "ILoveUsingSimplePasswords1".

You remove the last character and get "ILoveUsingSimplePasswords".

And then I change the password to "ILoveUsingSimplePasswords2".

Now here are those 3 "passwords" hashed.

  • 5c30739dfd7a5df387f9a3e6c08a026831314e8cc8df4f18e3c2a7baddf30bb2
  • a78cb4f0ddf5513862e97e20fe8f331d08bbb5aacf0ac14c0b6a0f1b036a7b6b
  • 9385bd96fb795abd7204d27990e8c7b2bf929bac772b6f8e3b875e8a313be5cb

Can you tell which of the 3 is "ILoveUsingSimplePasswords" and can you identify where I've added 1 or 2 to the end? You can't because it's not how hashing works.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 20 points 1 year ago (1 child)

    This is not what he meant. If the password is xyz he stores the hash (f*) for xyz and xy. When you change your password to xyb, it compares fxyz to the first saved hash and a truncated fxy to the second saved hash, flagging if you've only changed the last character. The mask length could be arbitrary and there can be many saved hashes at the expense of making password resets slow.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •