Hacker News Reader

then you know that your passwords aren't hashed on their servers

This is the immediate alarm that went off in my head reading about this. I've never seen this before either and it sounds like an idea from someone who means well but doesn't understand what they are doing.

View on HN

They could hash each combination. Probably reduces security, but not a dead giveaway.

It would effectively be a dead giveaway. Exhaustively searching all combinations of three characters takes trivial time even in an excruciatingly slow hash.

but it prevents MitM spying.

Hashing passwords is not done to prevent MitM, it's done to prevent/delay password disclosure if the database is hacked.

Entering partial passwords prevents MITM. OP was just explaining how partials could be implemented securely by hashing each combination; he wasn't saying hashing prevented MITM.

So does TLS, without the ridiculous downsides.

Yep, I think this is what happens.

Reply on news.ycombinator.com