News for hackers. Stuff that matters.

A comment on WeChat permanently closes account after user sets offensive password. Parent comment

Re:WeChat permanently closes account after user sets offensi... by Dylan16807 on Friday June 05, 2020 @03:51PM (#23433130)
No. The database only contains the double hash. It still needs to be bruteforced.

There is zero downside to doing an extra hash, except the chance that someone codes such a basic thing wrong.

[ Parent | on HN ]
Re:WeChat permanently closes account after user sets offensi... by 0x0 on Friday June 05, 2020 @04:03PM (#23433280)
No. Other websites on the internet, where the user also registered with the same email and password, contain the single hash.
[ Parent | on HN ]
Re:WeChat permanently closes account after user sets offensi... by Dylan16807 on Friday June 05, 2020 @04:18PM (#23433463)
Oh, I see. Other websites give you the 'password' to this website.

But only if neither site uses salt, so salt all your hashes. (Not even a salt is necessary here, just a site-wide addition would be fine. Or honestly you could just use a hash that wouldn't be used by a site too dumb to salt their database.)

[ Parent | on HN ]