Tell HN: Bash.org Is No More

Re:Tell HN: Bash.org Is No More by BuildTheRobots on Thursday January 11, 2024 @09:50AM (#38952896)

(sticking with the obliviousness for a moment,) Would they need to store the plaintext password? Hashing every word typed isn't efficient but it's possible to achieve without knowing the plaintext.

It reminds me of Facebook allowing login even when you've mistyped your password: https://security.stackexchange.com/questions/214814/why-can-...

[ Parent | on HN ]

Re:Tell HN: Bash.org Is No More by GTP on Thursday January 11, 2024 @10:20AM (#38953374)

Yes, that's true. But since HN is famously hosted on a single not-so-powerful server, that would be unlikely to be the employed solution.

[ Parent | on HN ]

Re:Tell HN: Bash.org Is No More by BuildTheRobots on Thursday January 11, 2024 @10:38AM (#38953664)

Considering how laggy the comment box is on reddit, it makes me wonder if they're not already doing something similar, but client-side in js. I guess it would expose the salt though.

[ Parent | on HN ]

Re:Tell HN: Bash.org Is No More by GTP on Thursday January 11, 2024 @11:45AM (#38954699)

Exposing the salt isn't an issue, it can (and should) even be a different one for each account.

[ Parent | on HN ]

Re:Tell HN: Bash.org Is No More by latexr on Thursday January 11, 2024 @01:08PM (#38956129)

> Hashing every word typed

Wouldn’t work if your password contains spaces.

[ Parent | on HN ]

Re:Tell HN: Bash.org Is No More by KETHERCORTEX on Thursday January 11, 2024 @04:24PM (#38959306)

They just hash every substring that can be a password.

Don't write long comments. Show some love to HN's server carrying its O(n^2) burden.

[ Parent | on HN ]

Re:Tell HN: Bash.org Is No More by bbarnett on Thursday January 11, 2024 @01:38PM (#38956637)

But it does! They, instead, hash each letter independently, that's how they can do this.

[ Parent | on HN ]