News for hackers. Stuff that matters.

A comment on Password Requirements: Myths and Madness. Parent comment

Re:Password Requirements: Myths and Madness by AstralStorm on Friday December 23, 2022 @01:17AM (#34102811)
It's not that easy, normally having function have a big avalanche factor - even one bit changes the whole hash. There are some malleable having algorithms but they're necessarily less secure. If you're sending multiple hashes to check nobody is stopping the user from sending garbage, except their lack of JS/browser skill.

If you're sending the plaintext password, what are you doing using a hash? When your backend is compromised, attacker will just grab all the password when they're getting changed.

[ Parent | on HN ]
Re:Password Requirements: Myths and Madness by csydas on Friday December 23, 2022 @10:40AM (#34106954)
No, I think you misunderstood the post I responded to a bit.

In the case where the current password is captured on the password change, you have two plaintext values that aren't stored yet and you can just do some text analysis and understand how close they are.

With past passwords, you just take the current input and transform it with common transformations (adding numbers, incrementing/decrementing numbers, etc), hash it, and see if it matches a previous password hash. If so, then you know that they're using a very similar password pattern repeatedly.

[ Parent | on HN ]