4 ms·
Wait, that's still awful! It allows you to crack each character individually. For instance, a 10-letter password requires 26^10 ~= 1.4e14 attempts to test every
by benkuhn 10y ago
Wait, that's still awful! It allows you to crack each character individually. For instance, a 10-letter password requires 26^10 ~= 1.4e14 attempts to test every option if you only have a hash of the full password, but only 10*26 = 260 attempts to test every option for every individual character.
- brassic 10y agoI have to use two passwords to login to Lloyds bank. One conventional password (which is presumably stored salted and hashed) and one where I have to enter characters from three positions they choose. The latter is intended to mitigate the risk of using your account from a vulnerable computer. The former takes care of vulnerabilities on their end (as far as any password can).
- Symbiote 10y agoCould they implement something like: Password: money Secret word: ABCD If they're going to ask for two characters from the secret word, they could then hash saltmoneyAB saltmoneyAC saltmoneyAD saltmoneyBC saltmoneyBD saltmoneyCD and check against the relevant one.
- nrki 10y agoI may be incorrect on the "hash each letter individually" part. But this is combined with a password.