Re:Dropbox prompts password resets
by i386 on Friday August 26, 2016 @12:16AM
(#12364204)
Because $password isn't the original value. It should be a hash written when the password is set and the original is thrown away.
[ Parent
| on HN ]
You don't need original password, hash the hash.
if date < '2016-01-01'
return newly_hashed == new_hash(old_hash($password))And hash twice again during login/password lookup then? Can be done, but tedious.
Yes, but it happens only the first time, if you update the stored hash with newHash(plaintext_password)
Sure, not ideal, but would prevent mass password updates.
@pixelcort is correct here, it is possible to do it that way:
If a DB has an old hash, call it V1 obtained as H1(password), one can apply a newer hashing scheme H2(V1) and save V2. To avoid having two classes of users forever one can always apply H2(H1(password)) for new users.
It appears though, that this is not what dropbox did, when they changed the scheme to H2 in 2012, applying H2(password) for new users instead.