Hacker News Reader

Comment by EwanToo | Hacker News Reader

I agree this law doesn't seem to outlaw hashed passwords, it simply means that you need to store 2 copies of the password - one hashed, and one in plain text.

It's totally legal to store the hashed value with your live database as normal to provide authentication, and store the plain text version in a write only file on a separate system to try and give some additional level of security. This isn't a great solution, but it does provide hashed passwords for regular work, and plain text for when the police ask for it.

It's obviously a pretty stupid law, but to say it "outlaws" hashed passwords is just nonsense.

View on HN

I agree this law doesn't seem to outlaw hashed passwords, it simply means that you need to store 2 copies of the password - one hashed, and one in plain text.

You are splitting hairs. It outlaws passwords where only the (salted) hash and not the plaintext is stored, which is the whole point of what's commonly known as "hashed passwords".

store the hashed value with your live database ... and store the plain text version in ... a separate system

Call that seperate system "the moneypot". I'm tempted to suggest that people just try that and see how that works out for them, given the inevitablity of failures of security and vigilance. But for the sake of the rest of us, let's not.

I didn't say it was a smart law, but I'm also not splitting hairs.

If someone has that level of control over your system to access a write only file on a separate secured system, make a copy and extract it somewhere else, they probably also have enough access to insert a piece of code into your authentication system to dump all the plaintext passwords to a separate file as people login over time.

The message remains the same for all users regardless of this law - Don't reuse passwords, you can't trust their security.

I'll be more specific about failures of security and vigilance: "separate secured system" aren't always as seperate and secured as they should be. Assume that all computers can connect to the internet these days unless specifically configured otherwise, and data gets copied, and copies get left lying around. e.g. the classic "left the laptop on a train" http://www.independent.co.uk/news/uk/politics/exclusive-new-... / "cd got lost in the mail" problem.

Ultimately, if two systems need to exchange data in any way, even in one direction only, they cannot truly be described as separate.

I'm also not splitting hairs.

of course you aren't. We know this because you say you aren't. What you are is making a nuanced distinction between what you mean when you say "stores hashed passwords" and what is commonly meant by that.

Reply on news.ycombinator.com