Posts by Anonymous C0ward 643 publicly visible posts • joined 24 Jan 2012
If salted hash is used, the salt values for all existing passwords are necessarily stored in the authentication database along with the hashes. So the check for same password simply salts and hashes the candidate with each of them and checks if the resulting hash is already in the database.
So you have to read every row in the table and do some computation on it, before inserting your single new row? Nice DDOS opportunity.
Maybe you don't lose your text-based log files. Maybe unless you're a real power user you won't need to do things differently at all.
*That makes it worse.* It needs to offer a significant advantage to be worth bothering to change. It is not enough to not be evil.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
