Re:Gab Has Been Breached
by lultimouomo on Friday March 05, 2021 @05:29PM
(#26363055)
Let's assume that the Gab user used a long and complicated password, that happened to hash-collide with "password". How do you know that Gab would have accepted "password" as a password? All we know is that it accepted the long and complicated one.
This is obviously moot, as a collision is exceedingly unlikely in this case, but still.
Password policy enforcement is done on the plain text password, during initial account creation or during a password change workflow. Then, the password and salt are hashed and the result and the salt are stored.
When the user tries to login they then provide the plaintext password; the salt is retrieved, it is added to the password, the result is hashed, and the hash is compared to the stored hash.
Since the space of all passwords is larger than the space of all hashes, there is a theoretical possibility that the user can provide a different password than the original plaintext, and this new plaintext + the salt happens to have the same hash, so the login system (which has no idea what the original plaintext was) will accept it.
With any halfway decent cryptographic hashing function this is less likely than winning every lottery in the world at once with the same ticket.