3 ms·
Does it need to be plaintext though? Just a theoretical possibility: They can maintain hashes of potentially offensive passwords. You then need to just compare
by sn41 6y ago
Does it need to be plaintext though? Just a theoretical possibility: They can maintain hashes of potentially offensive passwords. You then need to just compare hashes. This is somewhat like registering all domains which can harm your reputation yourself, before anyone else does.
I am not suggesting that this is what WeChat does, but I think it is possible to have a blacklist without plaintext transmission.
- zeeZ 6y agoThis only works if the password hashes aren't salted
- hunter2_ 6y agoBut you just do the comparison before hashing.
- acituan 6y ago> They can maintain hashes of potentially offensive passwords Assuming they want to check against all casing combinations, the list of hashes would be 3 orders of magnitude bigger for a list of 7 letter words. If they want to check for substrings or spelling variations, list would combinatorially explode.