Hacker News Reader

Perhaps I'm misunderstanding the security model behind this, but why should the site be storing my password's length at all? Why does it know I have a 10th character at all? The site should just have a hash of my password (normalizing the length).

View on HN

I can't think of any way that this could be made secure outside of specialized hardware. If a system exists that can query some static data for whether a selected subset of characters is correct, then brute-forcing the underlying password becomes stupidly trivial.

Similarly for pre-hashing certain subsets; a four-character password can be too easily brute forced.

I guess (hope) they just have a collection of patterns that they apply (like (3, 9, 11, 12, 15) from the OP), and when they store your password's hash, they also store the hash of those several characters so that they can present the pattern to you later and check whether you matched the pattern correctly.

5 characters is "pretty simple to bruteforce" area, and now you've got 5 characters, replicate that for the other patterns, and you can probably crack the whole password pretty easy

so they have built a rainbow table ready to download

Reply on news.ycombinator.com