Hacker News Reader

Comment by benkuhn | Hacker News Reader

Wait, that's still awful! It allows you to crack each character individually. For instance, a 10-letter password requires 26^10 ~= 1.4e14 attempts to test every option if you only have a hash of the full password, but only 10*26 = 260 attempts to test every option for every individual character.

View on HN

I have to use two passwords to login to Lloyds bank. One conventional password (which is presumably stored salted and hashed) and one where I have to enter characters from three positions they choose. The latter is intended to mitigate the risk of using your account from a vulnerable computer. The former takes care of vulnerabilities on their end (as far as any password can).

Could they implement something like:

Password: money

Secret word: ABCD

If they're going to ask for two characters from the secret word, they could then hash

  saltmoneyAB
  saltmoneyAC
  saltmoneyAD
  saltmoneyBC
  saltmoneyBD
  saltmoneyCD

and check against the relevant one.

I may be incorrect on the "hash each letter individually" part. But this is combined with a password.

Reply on news.ycombinator.com