Gmail password first character is case insensitive on mobile device

Re:Gmail password first character is case insensitive on mob... by eterm on Saturday October 09, 2021 @12:18PM (#28811094)

You can't compare hashes like that unless they're not salted.

The same password won't hash to the same thing without the same salt so you can't compare them like that.

(If you could, then you would notice multiple users with the same hashes, i.e. the same passwords).

To verify a hash you need to retrieve the user's salt (typically stored with the hash the algorithm in a single string) then re-hash with the same salt.

[ Parent | on HN ]

Re:Gmail password first character is case insensitive on mob... by BoorishBears on Saturday October 09, 2021 @01:18PM (#28811576)

You're really grilling someone for not fetching salts in psuedocode?

[ Parent | on HN ]

Re:Gmail password first character is case insensitive on mob... by eterm on Saturday October 09, 2021 @02:44PM (#28812180)

It's not about fetching salts, it's about the whole approach; you literally can't approach it that manner.

[ Parent | on HN ]

Re:Gmail password first character is case insensitive on mob... by BoorishBears on Saturday October 09, 2021 @05:55PM (#28813658)

I guess they had faith that readers would be experienced enough to connect the dots.

Given the forum I too would have believed that to a reasonable assumption, but this thread shows it may not have been.

[ Parent | on HN ]