50 ms·
That's not necesarily true. They could store a full password hash and a hash of the 4th and 17th character separately.
by thehappypm 7y ago
That's not necesarily true. They could store a full password hash and a hash of the 4th and 17th character separately.
- tonyedgecombe 7y agoA hash of individual characters would be susceptible to a rainbow attack.
- heavenlyblue 7y agoNot if they use salt
- nucleardog 7y agoOkay, so now it's a brute which requires, at most, a couple hundred hashes (or less for a typical user's character set). Even for a very expensive algorithm, this is an extremely short operation.
- pornel 7y agoHashes can't protect the content if it's feasible to enumerate all possible values of the content. You can't hide individual letters of alphabet with a hash. Not even with a salt and an expensive hash. It's a hopeless case where a brute-force attack takes only 26 times (or 676 for a pair of letters) longer than a comparison you do during normal operation. BTW: it's also not possible to use hashes to hide/anonymize phone numbers or IP addresses. The attacker can generate hashes of all possible values and see which one is it.
- thehappypm 7y agoLet's say my password is NmsWQlWj1kzS534ojygJ. The 4th and 17th characters are W and j. Even if those two characters are stored in plain text, how exactly does that compromise my password?
- brycesbeard 7y agoThey could hash the full password and just store the two characters in clear text, no?