Re:Hotmail: Your password was too long, so we fixed it for you
by msderosa on Friday September 21, 2012 @11:08PM
(#4556982)
The password hash has always been computed on the first n < 16 characters of the plain text password. What I suspect is going on now though, is that Hotmail is transitioning to accepting arbitrarily sized, plain text passwords. Before Hotmail can change the code though, they need to get the current users used to entering the <= 16 characters of their 'actual' plain text password. If they just change the code, everyone who has a > 16 character password will find they cant log in. and chaos will ensue.
[ Parent
| on HN ]
Re:Hotmail: Your password was too long, so we fixed it for you
by stouset on Saturday September 22, 2012 @10:12AM
(#4557874)
Doubtful. The implementation is trivial. You just try both during the authentication step. If the password isn't recognized by the full hashing algorithm, try it against the first 16.