Hacker News Reader

This would break passwords like "foofoo", since they'd think it was already doubled, they'd check "foo" against the hash and it would fail. Then again, you can get around that with doubling it again after checking, so I don't know.

View on HN

Why is this a problem? If your password is "foofoo" and was set after the cutoff, then it won't be halved; if it is "foofoo" and was set before the cutoff, it will be halved, and then not match the password in the database, as intended.

this, i'm not sure why it is hard to see that this is easy to implement without storing passwords in plaintext.

You have to have stored the last password change date, which many systems don't do.

If they didn't before, they can start storing it to implement this.

Passwords prior to the doubling were a fixed length, so they could always assume the first eight characters of a 16 character password (which hasn't been changed manually) is the original password.

Of course, anyone who has a leak of the original passwords can equally just send a a double of it, so I'm not sure what benefit this is supposed to be offering.

Reply on news.ycombinator.com