3 ms·

I actually like 2. I wish more things used 2. My keys are plenty strong, but when I mistype a strong key (which is plausible seeing as I can't see what I'm typ

I actually like 2. I wish more things used 2. My keys are plenty strong, but when I mistype a strong key (which is plausible seeing as I can't see what I'm typing) then I'm fine with sacrificing some strength to just accept it. My key is already well beyond practical attack anyway. That said, if you WERE to use something like 2, you'd have to be much more diligent about enforcing good passwords, also you'd have to come up with some kinda scheme that could work with "close enough" and not reveal information about the password.

dysfunction 12y ago
Even assuming 2 is a good idea, I have no idea how that could be implemented. A major desirable property of a good password hashing algorithm is that slightly differing inputs should produce wildly differing hashes, and the login authenticator should only ever know the password hash and not the password itself.
- GhotiFish 12y ago
  I know. I've being thinking about how to do it, currently it involves having N hashs where you generate them like: echo -n "password" | md5sum 5f4dcc3b5aa765d61d8327deb882cf99 - echo -n "assword" | md5sum 297dbe7699dcfa60609bf9e667e2e4dc - echo -n "pssword" | md5sum 537319a7934aea9825d1af85df588fde - echo -n "pasword" | md5sum 22e5ab5743ea52caf34abcc02c0f161d - echo -n "pasword" | md5sum 22e5ab5743ea52caf34abcc02c0f161d - ect, then check the submitted password by testing it against these hashes by removing characters in the same fashion. Just as an early idea. I think it's a good idea, what if you could encourage users to use stronger passwords by telling them that "the system will forgive near misses, so don't be afraid"?