Passwords For Your Facebook Account

Re:Passwords For Your Facebook Account by joejohnson on Wednesday May 02, 2012 @05:20PM (#3921254)

Given hash(password), how do they get hash(password-inverted)? That requires going from hash(password) -> password -> password-inverted -> hash(password-inverted), right?

I think that first step (un-hashing) is impossible for a cryptographically secure hashing algorithm.

Edit: archivator explained it me :)

[ Parent | on HN ]

Re:Passwords For Your Facebook Account by archivator on Wednesday May 02, 2012 @05:28PM (#3921294)

0x0 is saying that when you receive the password you can do 3 checks. No need to invert the hash function there.

Also, inverting a hash function is impossible (the size of the range is less than the size of the domain). Finding a collision, on the other hand, is not.

[ Parent | on HN ]

Re:Passwords For Your Facebook Account by joejohnson on Wednesday May 02, 2012 @05:37PM (#3921343)

Ah, yes. Of course, thank you.

[ Parent | on HN ]

Re:Passwords For Your Facebook Account by kijin on Wednesday May 02, 2012 @05:32PM (#3921318)

Facebook's servers get to see your plaintext password for a fraction of a second every time you log in. That's their opportunity.

[ Parent | on HN ]

Re:Passwords For Your Facebook Account by r00fus on Wednesday May 02, 2012 @07:55PM (#3921770)

Hell, wasn't Zuck infamous for using the mis-entered password of users to break into their email accounts at Harvard?

Even if that tale is apocryphal, the underlying moral is true - your security is greatly undermined if you reuse your password (or key) across sites - any malicious site operator (or even an honest one that has their security broken) will expose you.

[ Parent | on HN ]

Re:Passwords For Your Facebook Account by jessriedel on Wednesday May 02, 2012 @06:54PM (#3921605)

Thanks for asking this. I was confused too.

[ Parent | on HN ]