News for hackers. Stuff that matters.
Re:The Top 50 Gawker Media Passwords by aamar on Wednesday December 15, 2010 @03:09PM (#2009585)
I think good practices around encryption/storage of passwords would make it infeasible to check how many times a password is already in your database.

How about instead just implementing a blacklist of unacceptable passwords?

Re:The Top 50 Gawker Media Passwords by Kadrith on Wednesday December 15, 2010 @05:42PM (#2010142)
Wouldn't you just need to hash the password and do a lookup on the table to see how many results were returned?
Re:The Top 50 Gawker Media Passwords by aamar on Wednesday December 15, 2010 @08:55PM (#2010803)
If you are generating a per-password salt, that won't work. In order to find prior occurrences of a given password, you would have to hash the password for every salt value that you've ever used. And since you're using BCrypt[1], that will be very slow.

[1] http://codahale.com/how-to-safely-store-a-password/