4 ms·
That doesn't tell me anything. :/ As far as I can tell, you're implying an attacker can determine a password using timing of hash comparisons. How is this any
by dmpk2k 12y ago
That doesn't tell me anything. :/
As far as I can tell, you're implying an attacker can determine a password using timing of hash comparisons. How is this any different (just more complicated) than a regular brute force attack?
- Gurkenmaster 12y agostrcmp will stop at the end of the string. (the first zero or \0) Comparing the hashes ABC\0DEF and ABC\0XYZ will result true. There are a lot of hashcollisions which make finding a password a lot easier but the password won't work with sites that don't use strcmp.