3 ms·
That's functionally equivalent to storing the password in plaintext. The individual letter hashes would be trivial to reverse.
by teraflop 15y ago
That's functionally equivalent to storing the password in plaintext. The individual letter hashes would be trivial to reverse.
- NLips 15y agoIt would be _easier_ - you still need to know the hashing algorithm and salt. I suppose since it's the TSA, they may use encryption and an HSM instead of hashes.
- Robin_Message 15y agoKerckhoffs's principle: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. So you can assume the algo is public and the salt too (assume someone has a dump of your source code and your database - how do you keep the salt secret? You can't. This is the case where all the effort to protect passwords and use strong hashes is aimed at.) The solution of "enter your old password" when you enter the new one is simple and doesn't compromise security.
- NLips 15y agoI agree, but "password is not secure if everything about the system, except the key, is public knowledge" is better than "password is saved in plain text".