2 ms·
Given hash(password), how do they get hash(password-inverted)? That requires going from hash(password) -> password -> password-inverted -> hash(password-invert
by joejohnson 14y ago
Given hash(password), how do they get hash(password-inverted)? That requires going from hash(password) -> password -> password-inverted -> hash(password-inverted), right?
I think that first step (un-hashing) is impossible for a cryptographically secure hashing algorithm.
Edit: archivator explained it me :)
- archivator 14y ago0x0 is saying that when you receive the password you can do 3 checks. No need to invert the hash function there. Also, inverting a hash function is impossible (the size of the range is less than the size of the domain). Finding a collision, on the other hand, is not.
- joejohnson 14y agoAh, yes. Of course, thank you.
- kijin 14y agoFacebook's servers get to see your plaintext password for a fraction of a second every time you log in. That's their opportunity.
- r00fus 14y agoHell, wasn't Zuck infamous for using the mis-entered password of users to break into their email accounts at Harvard? Even if that tale is apocryphal, the underlying moral is true - your security is greatly undermined if you reuse your password (or key) across sites - any malicious site operator (or even an honest one that has their security broken) will expose you.
- jessriedel 14y agoThanks for asking this. I was confused too.