Re:McGill will double your password if you don’t do it first
by StavrosK on Tuesday November 18, 2014 @10:11PM
(#8628007)
This would break passwords like "foofoo", since they'd think it was already doubled, they'd check "foo" against the hash and it would fail. Then again, you can get around that with doubling it again after checking, so I don't know.
[ Parent
| on HN ]
Re:McGill will double your password if you don’t do it first
by azernik on Tuesday November 18, 2014 @10:54PM
(#8628150)
Why is this a problem? If your password is "foofoo" and was set after the cutoff, then it won't be halved; if it is "foofoo" and was set before the cutoff, it will be halved, and then not match the password in the database, as intended.
Re:McGill will double your password if you don’t do it first
by rafekett on Tuesday November 18, 2014 @11:30PM
(#8628289)
this, i'm not sure why it is hard to see that this is easy to implement without storing passwords in plaintext.
Re:McGill will double your password if you don’t do it first
by StavrosK on Wednesday November 19, 2014 @06:14AM
(#8629373)
You have to have stored the last password change date, which many systems don't do.
Re:McGill will double your password if you don’t do it first
by jtheory on Wednesday November 19, 2014 @06:42AM
(#8629455)
If they didn't before, they can start storing it to implement this.
Re:McGill will double your password if you don’t do it first
by semanticist on Thursday November 20, 2014 @01:23PM
(#8637202)
Passwords prior to the doubling were a fixed length, so they could always assume the first eight characters of a 16 character password (which hasn't been changed manually) is the original password.
Of course, anyone who has a leak of the original passwords can equally just send a a double of it, so I'm not sure what benefit this is supposed to be offering.