News for hackers. Stuff that matters.

A comment on Show HN: Password validity hinting. Parent comment

Re:Show HN: Password validity hinting by latitude on Saturday March 10, 2012 @06:12PM (#3689007)
> This approach requires granting access to read the raw password hash to the password-tester application

No, it doesn't.

[ Parent | on HN ]
Re:Show HN: Password validity hinting by sk5t on Saturday March 10, 2012 @08:16PM (#3689261)
It does. What I mean by 'the application' is the backend / web app.

To put it another way, a better design allows no application code to read the hash from storage; the application can only ask the storage or security service to compare a supplied value for correctness. Fail enough times in rapid succession and the security service locks the account for a few minutes, preventing any comparisons during that period.

Opening the door to testing the hash itself outside of these constraints is the weakness I am suggesting.

Also thanks for the downvote.

[ Parent | on HN ]
Re:Show HN: Password validity hinting by latitude on Saturday March 10, 2012 @08:53PM (#3689324)
No, it does not :)

http://news.ycombinator.com/item?id=3689024

And I didn't downvote you (not that I even can).

[ Parent | on HN ]