Hacker News Reader

A common design pattern flaw is only hashing the first x characters of the password and storing the result during sign up but then hashing the entire password on log in which results in a miss-match during authentication.

If you use long passwords try removing the last character and seeing if you can still log in to your favorite website - on many you probably can.

View on HN

Yeah, I'm aware the problem was truncation, it just took me a few tries to figure it out. My making a typo seemed much more probable than something that stupid being true.

In practice, what sort of process do you think would cause someone to implement this mistake? It seems obviously dumb to truncate something that you're hashing anyway. (To truncate it to something human relevant anyway, rather than like 512 characters).

That's why I asked if it was in some bugged library, it seems bizarre that the same totally boneheaded design would be recreated independently. It's not just that it truncates it, it's that it does it differently.

Reply on news.ycombinator.com