3 ms·
You can't compare hashes like that unless they're not salted. The same password won't hash to the same thing without the same salt so you can't compare them li
by eterm 5y ago
You can't compare hashes like that unless they're not salted.
The same password won't hash to the same thing without the same salt so you can't compare them like that.
(If you could, then you would notice multiple users with the same hashes, i.e. the same passwords).
To verify a hash you need to retrieve the user's salt (typically stored with the hash the algorithm in a single string) then re-hash with the same salt.
- BoorishBears 5y agoYou're really grilling someone for not fetching salts in psuedocode?
- eterm 5y agoIt's not about fetching salts, it's about the whole approach; you literally can't approach it that manner.
- BoorishBears 5y agoI guess they had faith that readers would be experienced enough to connect the dots. Given the forum I too would have believed that to a reasonable assumption, but this thread shows it may not have been.