Re:Ransomware – Unauthorized access to Fujifilm servers
by babelfish on Thursday June 03, 2021 @01:13AM
(#27377458)
I have a friend who works at G that told me shortly after he started working there, he accidentally typed some portion of his password into another website, at which point his laptop immediately locked down and he was forced to change his password before doing anything else.
[ Parent
| on HN ]
Re:Ransomware – Unauthorized access to Fujifilm servers
by tremon on Thursday June 03, 2021 @05:10AM
(#27378766)
Are you implying Google had his password stored in reversible form?
Re:Ransomware – Unauthorized access to Fujifilm servers
by londons_explore on Thursday June 03, 2021 @06:07AM
(#27379125)
This is what OP is talking about:
https://chrome.google.com/webstore/detail/password-alert/noo...
And yes, it does store a hash of the password on the local machine, although I suspect it's only a 32 bit hash or something so you can't 'crack' it to recover the original password.
Re:Ransomware – Unauthorized access to Fujifilm servers
by weird-eye-issue on Thursday June 03, 2021 @05:58AM
(#27379067)
Nothing about the comment that you replied to would require them to store their password in "reversible form"
Re:Ransomware – Unauthorized access to Fujifilm servers
by londons_explore on Thursday June 03, 2021 @09:25AM
(#27380927)
> some portion of his password
Doing a partial string match on a password would effectively require it in reversible form. Even if you hashed all the possible substrings of the password, it would be trivial to brute force given all the hashes of the same string with one extra character on the end...
But OP was mistaken - the tool Google uses only alerts if the entire password is typed. Meaning that OP's friend was careless with password hygiene. As is nearly every new Google employee.