3 ms·
Right, but usually designs for password systems assume that the whole system is transparent to the attacker, in which case hashing it before use doesn't buy you
by bscphil 7y ago
Right, but usually designs for password systems assume that the whole system is transparent to the attacker, in which case hashing it before use doesn't buy you anything. If your input phrase is low entropy then a hacker can compute sha512sum(low entropy phrase) just as easily as you can.
So to get anything out of doing this is basically just assuming that your attacker won't know (or guess) that you're doing this. Maybe it doesn't hurt, but I wouldn't trust it with a low entropy passphrase. I suppose one use for it would be getting more entropy on sites with low password length requirements, like 10-15 characters max.
Another possible problem is if your computer gets stolen and the `echo xxx | sha512sum` command is in your .bash_history file. To me this seems to add a lot of additional risk.