News for hackers. Stuff that matters.

A comment on Auditor's response to "Our security auditor is an idiot" (Update 3). Parent comment

Re:Auditor's response to "Our security auditor is an idiot" ... by pyre on Friday July 29, 2011 @11:08AM (#2822171)
It's not reversible, but block encryption should be easy to compare for similarity. If the old password is 5 blocks, and 4 of 5 blocks match the new password (in order)... I'm guessing this is what the gp was talking about. (of course block size matters, if all passwords are a single block that doesn't help)
[ Parent | on HN ]
Re:Auditor's response to "Our security auditor is an idiot" ... by mayank on Friday July 29, 2011 @01:37PM (#2822899)
That's why we use a fresh salt for each password. Bcrypt incorporates a fresh salt into each new hash. Your and the GP's concern in this area is not warranted.
[ Parent | on HN ]