Re:Tell HN: Zoom truncates passwords to 32 chars
by recursive on Wednesday April 01, 2020 @12:12PM
(#22750273)
If they could just fix it, it seems like they must be storing user credentials insecurely. At least, I can't figure out how to fix something like this without at least a password change for all users.
[ Parent
| on HN ]
Re:Tell HN: Zoom truncates passwords to 32 chars
by Someone on Wednesday April 01, 2020 @12:33PM
(#22750571)
You mark the existing hashes as “only use the first 8 characters to compute the hash” and, from now on, clear that bit for every password that gets changed and for new accounts.
When all bits have been cleared, remove the logic for inspecting the bit and the mark bit. If that takes too long, force your users to update their password at whatever pace suits you.
Re:Tell HN: Zoom truncates passwords to 32 chars
by duxup on Wednesday April 01, 2020 @12:14PM
(#22750307)
Oh I wouldn't be surprised.
A few years later I actually had visibility inside that bank due to my work. There was a whole IT team dedicated to "review this and fix the horrible decisions we made in the past". I didn't have visibility to their web interactions / front end and such but it wouldn't surprise me if that was just as much a project to clean up.
To their credit whenever I talked to the "clean up" type team they were super sharp guys and quite willing to listen to outside vendors (me) who sometimes saw stuff the guys inside maybe didn't.