News for hackers. Stuff that matters.

A comment on The “Cobra Effect” that is disabling paste on password fields. Parent comment

Re:The “Cobra Effect” that is disabling paste on password fi... by ams6110 on Sunday June 26, 2016 @02:23PM (#11981938)
then you know that your passwords aren't hashed on their servers

This is the immediate alarm that went off in my head reading about this. I've never seen this before either and it sounds like an idea from someone who means well but doesn't understand what they are doing.

[ Parent | on HN ]
Re:The “Cobra Effect” that is disabling paste on password fi... by ghayes on Sunday June 26, 2016 @02:45PM (#11982042)
They could hash each combination. Probably reduces security, but not a dead giveaway.
[ Parent | on HN ]
Re:The “Cobra Effect” that is disabling paste on password fi... by ryan-c on Sunday June 26, 2016 @03:14PM (#11982174)
It would effectively be a dead giveaway. Exhaustively searching all combinations of three characters takes trivial time even in an excruciatingly slow hash.
[ Parent | on HN ]
Re:The “Cobra Effect” that is disabling paste on password fi... by tajen on Sunday June 26, 2016 @03:56PM (#11982394)
but it prevents MitM spying.
[ Parent | on HN ]
Re:The “Cobra Effect” that is disabling paste on password fi... by admax88q on Sunday June 26, 2016 @05:47PM (#11982920)
Hashing passwords is not done to prevent MitM, it's done to prevent/delay password disclosure if the database is hacked.
[ Parent | on HN ]
Re:The “Cobra Effect” that is disabling paste on password fi... by whiteandnerdy on Monday June 27, 2016 @12:32PM (#11987285)
Entering partial passwords prevents MITM. OP was just explaining how partials could be implemented securely by hashing each combination; he wasn't saying hashing prevented MITM.
[ Parent | on HN ]
Re:The “Cobra Effect” that is disabling paste on password fi... by stouset on Monday June 27, 2016 @01:22PM (#11987690)
So does TLS, without the ridiculous downsides.
[ Parent | on HN ]
Re:The “Cobra Effect” that is disabling paste on password fi... by reitoei on Monday June 27, 2016 @04:24AM (#11984831)
Yep, I think this is what happens.
[ Parent | on HN ]