Skip to content

Comment on Top 250 cracked Gawker passwordsparent

Comments

Truncation to 8 characters is an entropy killer; limiting the range of characters by using the truncated strong hash as the input will reduce it further. In a weak system, you're more likely to find a collision that will effectively substitute for the original password. For two such systems to coexist, you'd need to enforce the use of passwords greater than 8 characters to prevent a crack on the weak system from working on the stronger one.

Thankyou. This is very interesting. Whenever I study cryptography I feel a bit like Alice going down the rabbit hole.

Thank god the safe best-practices are clear and simple in the majority of cases.

EDIT: in case anyone reading this is wondering, the safe best-practice is to USE BCRYPT.

http://codahale.com/how-to-safely-store-a-password/

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.