3 ms·
I do like the idea, but there's one problem (though maybe not a big problem.) The user still has to be smart about making passwords. For example, if Alice puts
by Mithrandir 16y ago
I do like the idea, but there's one problem (though maybe not a big problem.) The user still has to be smart about making passwords. For example, if Alice puts in "password" and clicks SHA-1 (same with another algo), she would get "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8". If Mallory is smart enough to think she'd choose "password" as her password, and sees "353e8061f2befecb6818ba0c034c632fb0bcae1b" (hash of the hash), he can easily figure it out. Basically, he just hashes all words in a dictionary before attacking via brute-force.
Of course, if Alice chooses "HeLlOWoRlD13485443&$%3" or similar, then it's harder for Mallory and even harder if she hashes it.
- 16s 16y agoI would hope users would use sentences rather than just one dictionary word. Don't use 'password' for your password. But you have a point, humans will be human. I could do checking for whitespace and length to mitigate that possibility a bit. Thanks for the feedback.