3 ms·
> ...and verify the password to make sure it is not one of the 10,000 most common known passwords by checking its hash Am I missing something here? 1. I navig
by alexggordon 12y ago
> ...and verify the password to make sure it is not one of the 10,000 most common known passwords by checking its hash
Am I missing something here?
1. I navigate to discourse
2. Select "try discourse"
3. "Sign Up"[0]
4. Dummy username/email
5. Password: 12345678
6. Wait, it succeeded? What did I just read?
Have they not implemented this yet? Maybe I'm the first person to test it? Definitely a common password[1]
[0] http://try.discourse.org/ http://try.discourse.org/
[1] http://www.cbsnews.com/news/the-25-most-common-passwords-of-2013/ http://www.cbsnews.com/news/the-25-most-common-passwords-of-...
- dspillett 12y ago> > ...and verify the password to make sure it is not one of the 10,000 most common known passwords by checking its hash That bit confuses me - why the need to check the hash? You have the password plain and you have the list plain, just compare the strings directly. If you have a hashed version of the list and are comparing hashed passwords to that, then you are hashing your passwords wrong: the parameters to your salt function should vary per-password so that people using the same password as each other (or someone using the same password for many accounts) are not obvious should your credentials store be compromised.
- alexggordon 12y agoExactly. I don't know why you need to check the hash, not to mention it doesn't seem to be working at all. If you're just checking to see if it's a common password, wouldn't it be easier to just store a dictionary?