News for hackers. Stuff that matters.

A comment on Weblog.sh – hosted blogging from the command-line. Parent comment

Re:Weblog.sh – hosted blogging from the command-line by thiht on Tuesday November 24, 2015 @10:42AM (#10621325)
>have MANY (but not too many) collisions so that it can not be brute-forced in any direction

I don't understand this part? Basically if I'm able to find a collision it's like I found the real password, so why is a function with many collisions better for password hashing? Is there a way to differentiate the collisions?

EDIT: typo

[ Parent | on HN ]
Re:Weblog.sh – hosted blogging from the command-line by iancarroll on Tuesday November 24, 2015 @12:11PM (#10622022)
You don't want collisions, as the entire point of a hashing algorithm is to _not_ have collisions. I'm not sure what the OP is talking about.

What you really want for password hashing is a key derivation function, which will generate a random, unique hash slowly.

[ Parent | on HN ]
Re:Weblog.sh – hosted blogging from the command-line by z3t4 on Tuesday November 24, 2015 @05:46PM (#10624123)
Lets say someone gains access to the password hashes, he/she can compute hashes until a match is found. And then login to that particular system, but does not know the secret (if there are many collisions, and the pw is random). I'm no expert though, and I assume that if someone gains access to all the password hashes, he/she already has access to the system.
[ Parent | on HN ]