4 ms·
(Hint: you can't truncate a hash and get a subset string of the original password to still work.)
by frisco 17y ago
(Hint: you can't truncate a hash and get a subset string of the original password to still work.)
- jhancock 17y ago+1 for frisco (hopefully most of us) that understands the basics of a one-way hash!! The more precise answer is they at least were storing password in plaintext.
- jedediah 17y agoIt could be that the bank was hashing the passwords all along, but just truncating the user's input before hashing it and comparing it to the saved value. Not that I think this is what happened, but I'm just saying it could be.
- deleted 17y ago[deleted]
- RobKohr 17y agoThen would would the newly entered shorter value match to? 123456 -> hash code 1 123 -> hash code 2 (which doesn't exist in their db)
- deleted 17y ago[deleted]
- euccastro 17y agoIf they did that, his old password would still work. His use of "no longer" implies that the password used to work before the policy change. Unless at some point they started rejecting long passwords just for being long, without checking them against the database. And this is just not plausible.