Re:Password Requirements: Myths and Madness
by wizofaus on Friday December 23, 2022 @01:49AM
(#34102952)
Yes, obviously, I'm just saying it's a potential vulnerability that doesn't exist if you don't store the LSH. The LSH doesn't need to be reversible - I'm just saying that you now have a situation where if you can find multiple people with the same LSH, if one their passwords becomes known to an attacker for any reason (the attacker could be one of those people!), the other passwords are now much easier to guess.
[ Parent
| on HN ]
There are no comments on this comment yet.