Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Does it really? What matters is NUM_POSSIBLE_KEYS / NUM_SAVED_HASHES, saving hashes for multiple casings of the password can't possibly increase the number of hashes by more than lowercasing the password would decrease the keyspace by.


You're right, I was thinking that the attacker didn't know the publicly available information that passwords were case insensitive. However, I would still be concerned that it unnecessarily increases the chances to exploit some weakness in the hash algorithm.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: