5 ms·
Again, not necessarily. This depends on the hashing scheme you use. Eg. if setting a correct password hash relies on you having access to private keys.
by madsbuch 4y ago
Again, not necessarily. This depends on the hashing scheme you use. Eg. if setting a correct password hash relies on you having access to private keys.
- bawolff 4y agoNo it does not. Either you allow bcrypt hashes, or this bug is inapplicable. If you are encrypting your hashes or something, then this bug cannot be leveraged.
- madsbuch 4y agoYes, for this very specific bug. This thread taked about having access to the database as a general attack vector.