3 ms·
It would be _easier_ - you still need to know the hashing algorithm and salt. I suppose since it's the TSA, they may use encryption and an HSM instead of hashe
by NLips 14y ago
It would be _easier_ - you still need to know the hashing algorithm and salt.
I suppose since it's the TSA, they may use encryption and an HSM instead of hashes.
- Robin_Message 14y agoKerckhoffs's principle: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge. So you can assume the algo is public and the salt too (assume someone has a dump of your source code and your database - how do you keep the salt secret? You can't. This is the case where all the effort to protect passwords and use strong hashes is aimed at.) The solution of "enter your old password" when you enter the new one is simple and doesn't compromise security.
- NLips 14y agoI agree, but "password is not secure if everything about the system, except the key, is public knowledge" is better than "password is saved in plain text".