Hacker News new | past | comments | ask | show | jobs | submit login

His analogy to exposing password hashes doesn't really work.

The primary reason you don't expose password hashes isn't that someone will break the hashing algorithm. It's that users come up with crappy passwords, and exposing the hashes would let an attacker do a brute-force search on the likely password space.

His other points are pretty good, though.




Good point. Let's say, for the sake of argument, that each of them have their own salt :)


Any reasonable password algorithm will have a unique salt for each password (well, a random long salt; you're highly unlikely to have collisions). Dictionary attacks still work.


Right. The analogy isn't bulletproof, but in conclusion it's pretty dumb to share information that could conceivably be used to extract some information or otherwise get an advantage when there's no reason to.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: