McGill will double your password if you don’t do it first

Re:McGill will double your password if you don’t do it first by Dylan16807 on Tuesday November 18, 2014 @07:24PM (#8627369)

Doubling doesn't provide a benefit, no matter how well they hash or don't hash.

[ Parent | on HN ]

Re:McGill will double your password if you don’t do it first by danudey on Tuesday November 18, 2014 @07:33PM (#8627417)

It annoys people into updating their password, for one.

[ Parent | on HN ]

Re:McGill will double your password if you don’t do it first by shit_parade on Tuesday November 18, 2014 @09:53PM (#8627971)

Which they could of accomplished with a password reset via email.

[ Parent | on HN ]

Re:McGill will double your password if you don’t do it first by fnordfnordfnord on Wednesday November 19, 2014 @09:34AM (#8630193)

It's a .edu. The password you just reset is the same as the password for their email.

[ Parent | on HN ]

Re:McGill will double your password if you don’t do it first by Aldo_MX on Tuesday November 18, 2014 @07:30PM (#8627401)

Whether it provides a benefit or not is unrelated to the fact that they don't need to know your plaintext password to use something like the regex I wrote to detect a string duplicated twice and extract the first match prior to hashing/checking against the DB.

[ Parent | on HN ]