4 ms·
> If you can reproduce the plaintext in any way you're guilty of storing plaintext passwords. Although I get your point, this statement is a bit too broad. Wh
by T-hawk 15y ago
> If you can reproduce the plaintext in any way you're guilty of storing plaintext passwords.
Although I get your point, this statement is a bit too broad. What about brute force? Get enough parallel hardware running fast enough and you can eventually reproduce the plaintext for any ciphertext or hashtext.
Besides brute force, there's also dictionary and rainbow table attacks to consider. Are you guilty if the plaintext can be reproduced by a table lookup? Are you guilty if you properly salted, but the salt storage was compromised too? Are you guilty if you enforced password-complexity requirements to foil a rainbow table, which led to the user writing down KuteK1tty!123 on her Post-it and a co-worker stole it?
These aren't easy questions, and there's no magic solutions, just a cloud of less-bad options.
- kbolino 15y agoSince we're on the subject of nitpicking, it's worth noting that under such circumstances you can produce a plaintext, and you can produce every plaintext of a certain length, but you cannot with certainty produce the plaintext unless there is only one possible plaintext meeting the constraints of the system.