3 ms·
Just out of curiosity: how do they understand password is weak if it is hashed?
by pvsukale3 6y ago
Just out of curiosity:
how do they understand password is weak if it is hashed?
- jhayward 6y agoI don't know what method GH is using, but the standard attack on hashed passwords is the use of rainbow tables[1] [1] https://en.wikipedia.org/wiki/Rainbow_table https://en.wikipedia.org/wiki/Rainbow_table
- gus_massa 6y agoMost modern hash algorithm like bcrypt or scrypt add automatically a salt to prevent the use of rainbow tables.
- mtmail 6y agoOP wrote "When I logged into" so presumably at this point the website can check the password against a password strength/complexity algorithm or top 1000 lists. Ther user had to change the password immediately. Only if you try to skip the step it will auto-reset.
- akerl_ 6y agoThe standard way is, as is pointed out in a parallel comment, checking when the user logs in (since they have to send their unhashed password to the server as part of logging in). Another approach is to use things like https://haveibeenpwned.com/ https://haveibeenpwned.com/ to detect users whose credentials are compromised and alert them. Another more involved approach is to actually try to find collisions with user passwords (using either common wordlists, generated wordlists, or straight brute force) and then notifying users if they find a hit.