Re:AdultFriendFinder was hacked
by rikkus on Sunday November 13, 2016 @02:26PM
(#12945104)
A common interview question for penetration testers is how you might design password storage to allow this 'feature' without having to store the plaintext password. It's possible, I guarantee it.
[ Parent
| on HN ]
That sounds interesting. Can you explain how to do it?
SSS doesn't look like it pertains to this discussion at all. How do you use this to store single digits securely?
If you have an method for requiring n out of m key parts to use the key, it is fairly easy to see how this can be used to require n out of m characters from a password. The only problem is that just a few characters doesn't have a large enough entropy to prevent the whole thing being brute forced very quickly.
> If you have an method for requiring n out of m key parts to use the key, it is fairly easy to see how this can be used to require n out of m characters from a password.
It doesn't sound very easy to me at all. Can you explain in more detail?