Bash [ -z hello ]

Re:Bash [ -z hello ] by rsl7 on Wednesday June 25, 2014 @10:34PM (#7947868)

But of course you could run it ten times and pick one of them. Or modify the instant answer to return ten or twenty. Not ideal or optimal, but there it is.

[ Parent | on HN ]

Re:Bash [ -z hello ] by mikeash on Wednesday June 25, 2014 @11:25PM (#7947989)

That hardly helps at all. Now instead of knowing your exact password, your attacker knows that your password is one of these 10-20 entries, and it's easy to just try them all.

[ Parent | on HN ]

Re:Bash [ -z hello ] by rsl7 on Thursday June 26, 2014 @09:43AM (#7949557)

Nobody has ever suggested this is a secure or ideal way to do it..

[ Parent | on HN ]

Re:Bash [ -z hello ] by mikeash on Thursday June 26, 2014 @10:25AM (#7949767)

My point is that it's not really even better.

[ Parent | on HN ]