Hacker News Reader

(Hint: you can't truncate a hash and get a subset string of the original password to still work.)

+1 for frisco (hopefully most of us) that understands the basics of a one-way hash!! The more precise answer is they at least were storing password in plaintext.

It could be that the bank was hashing the passwords all along, but just truncating the user's input before hashing it and comparing it to the saved value. Not that I think this is what happened, but I'm just saying it could be.

Then would would the newly entered shorter value match to?

123456 -> hash code 1

123 -> hash code 2 (which doesn't exist in their db)

If they did that, his old password would still work. His use of "no longer" implies that the password used to work before the policy change.

Unless at some point they started rejecting long passwords just for being long, without checking them against the database. And this is just not plausible.

Reply on news.ycombinator.com