6 ms·
I don't think that's necessarily true. Let's say they have all of the passwords stored as bcrypt hashes, and they also know the last time you changed your pass
by Nogwater 12y ago
I don't think that's necessarily true. Let's say they have all of the passwords stored as bcrypt hashes, and they also know the last time you changed your password. They could just update the application logic to check that your password is of the form <pw><pw> if your last change date is before X. Then to check the password, they just take the first half and check that against the hash.
- pwr22 12y agoOh God...
- deleted 12y ago[deleted]
- Dylan16807 12y agoDoubling doesn't provide a benefit, no matter how well they hash or don't hash.
- Aldo_MX 12y agoWhether it provides a benefit or not is unrelated to the fact that they don't need to know your plaintext password to use something like the regex I wrote to detect a string duplicated twice and extract the first match prior to hashing/checking against the DB.
- danudey 12y agoIt annoys people into updating their password, for one.
- shit_parade 12y agoWhich they could of accomplished with a password reset via email.
- fnordfnordfnord 12y agoIt's a .edu. The password you just reset is the same as the password for their email.
- Aldo_MX 12y ago"password123password123".match(/^(.+)\1$/)[1]
- deleted 12y ago[deleted]
- oxryly1 12y agoSo, in other words, this is an elaborate prank?
- tlrobinson 12y agoIt's a moderately aggressive way to get people to change their passwords (more aggressive than an email or prompt, less aggressive than forcing upon login)
- oxryly1 12y agoIf that happened to me I'd just keep the doubled password. It seems more secure (it's not), and I already remember it. This approach just seems dumb.
- StavrosK 12y agoThis would break passwords like "foofoo", since they'd think it was already doubled, they'd check "foo" against the hash and it would fail. Then again, you can get around that with doubling it again after checking, so I don't know.
- azernik 12y agoWhy is this a problem? If your password is "foofoo" and was set after the cutoff, then it won't be halved; if it is "foofoo" and was set before the cutoff, it will be halved, and then not match the password in the database, as intended.
- rafekett 12y agothis, i'm not sure why it is hard to see that this is easy to implement without storing passwords in plaintext.
- StavrosK 12y agoYou have to have stored the last password change date, which many systems don't do.
- jtheory 12y agoIf they didn't before, they can start storing it to implement this.
- semanticist 12y agoPasswords prior to the doubling were a fixed length, so they could always assume the first eight characters of a 16 character password (which hasn't been changed manually) is the original password. Of course, anyone who has a leak of the original passwords can equally just send a a double of it, so I'm not sure what benefit this is supposed to be offering.
- cheez 12y agoYep, basically: if(userHasUpdatedPw) { checkPw(hash(pw)) } else{ checkPw(hash(pw+pw)) }