3 ms·
> single long password could be used to authenticate as anyone. Only if everyone uses the same long prefix for password.
by ww520 2y ago
> single long password could be used to authenticate as anyone.
Only if everyone uses the same long prefix for password.
- buzer 2y agoNo. If the value of the cache key is simply true/false then someone would first login to their own account using the long password. This would result in storing: bcrypt(longpassword + 123456 + me@foobar.com) = bcrypt(longpassword) = hash1 -> true If they then try login as you@bar.com using same password there would be a cache lookup: bcrypt(longpassword + 1111111 + you@bar.com) = bcrypt(longpassword) = hash1 -> true