News for hackers. Stuff that matters.

A comment on McGill will double your password if you don’t do it first. Parent comment

Re:McGill will double your password if you don’t do it first by nemanja on Tuesday November 18, 2014 @10:06PM (#8627991)
That shouldn't be a factor if passwords are hashed, right? In other words, you don't have plain-text to pass on to the legacy system.
[ Parent | on HN ]
Re:McGill will double your password if you don’t do it first by akjsdfh on Wednesday November 19, 2014 @12:20AM (#8628412)
I was once told it was to prevent DoS-ing the back end of the system by submitting gigabytes to hash...

the check was an HTML input limit and there was no backend limit...

I was sad.

[ Parent | on HN ]
Re:McGill will double your password if you don’t do it first by eli on Wednesday November 19, 2014 @09:00AM (#8630004)
Maybe the interface expects an 8 character password even if it's hashed on the backend. Maybe it's hashed by something that expects a certain length because it's using a silly algorithm. Maybe not all systems use hashed passwords. Hard to say from the outside, but in my experience it's usually not because the developers were stupid or ignorant.
[ Parent | on HN ]