Hacker News Reader

A common interview question for penetration testers is how you might design password storage to allow this 'feature' without having to store the plaintext password. It's possible, I guarantee it.

View on HN

That sounds interesting. Can you explain how to do it?

https://en.wikipedia.org/wiki/Secret_sharing

SSS doesn't look like it pertains to this discussion at all. How do you use this to store single digits securely?

If you have an method for requiring n out of m key parts to use the key, it is fairly easy to see how this can be used to require n out of m characters from a password. The only problem is that just a few characters doesn't have a large enough entropy to prevent the whole thing being brute forced very quickly.

> If you have an method for requiring n out of m key parts to use the key, it is fairly easy to see how this can be used to require n out of m characters from a password.

It doesn't sound very easy to me at all. Can you explain in more detail?

How? I would be very interested in a solution for that, past the obvious and insecure "hash each character separately".

Reply on news.ycombinator.com