News for hackers. Stuff that matters.

A comment on A mode for password hashing. Parent comment

Re:A mode for password hashing by Someone1234 on Tuesday November 18, 2014 @09:38AM (#8623985)
If we followed that logic then why hash and or salt at all? Instead just "focus on not getting the table dumped in the first place."
[ Parent | on HN ]
Re:A mode for password hashing by protonfish on Tuesday November 18, 2014 @10:07AM (#8624110)
The greatest benefit to hashing is to protect the user's privacy from yourself (and other authorized administrators of the application) and as a guarantee that after the point hashing is implemented nobody can get easily expose plaintext version.

Even if all of these fancy hashing algorithms are implemented, it only makes it slightly more difficult to crack weak (common, short, dictionary word) passwords.

[ Parent | on HN ]
Re:A mode for password hashing by Someone1234 on Tuesday November 18, 2014 @10:15AM (#8624137)
If I'm an admin I could just dump the raw HTTP POST requests as they enter, bypassing hashing entirely.
[ Parent | on HN ]