4 ms·
> This approach requires granting access to read the raw password hash to the password-tester application No, it doesn't.
by latitude 15y ago
> This approach requires granting access to read the raw password hash to the password-tester application
No, it doesn't.
- sk5t 15y agoIt does. What I mean by 'the application' is the backend / web app. To put it another way, a better design allows no application code to read the hash from storage; the application can only ask the storage or security service to compare a supplied value for correctness. Fail enough times in rapid succession and the security service locks the account for a few minutes, preventing any comparisons during that period. Opening the door to testing the hash itself outside of these constraints is the weakness I am suggesting. Also thanks for the downvote.
- latitude 15y agoNo, it does not :) http://news.ycombinator.com/item?id=3689024 http://news.ycombinator.com/item?id=3689024 And I didn't downvote you (not that I even can).