Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This isn't necessarily true (and is very dependent on what your password was) - they could have iterated through lists of common passwords w/ special characters, hashed them, and compared them to their DB, forcing a pw reset for everyone that had a match.

edit - just want to state that if they disallow special characters it really is a terrible policy, my point is just that resetting your password isn't proof they are stored in plaintext



I doubt they did this, but I was just thinking about this problem--

Maybe they could have analyzed the plaintext password and stored information about the types of characters it contained and number of characters. Then they salt+hash the plaintext password and store the resulting hash. Now they know a little about the characters and length of the password without knowing the password itself.

Again, I doubt they did this.


Not salting passwords in 2018 is also idiotic lunacy.


This same exact strategy works with a salt as well.


He might have been referring to user specific salts? It would certainly be a lot more challenging for them to test every common password with every user's salt.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: