Hacker News Reader

Comment by GhotiFish | Hacker News Reader

I actually like 2. I wish more things used 2.

My keys are plenty strong, but when I mistype a strong key (which is plausible seeing as I can't see what I'm typing) then I'm fine with sacrificing some strength to just accept it. My key is already well beyond practical attack anyway.

That said, if you WERE to use something like 2, you'd have to be much more diligent about enforcing good passwords, also you'd have to come up with some kinda scheme that could work with "close enough" and not reveal information about the password.

View on HN

Even assuming 2 is a good idea, I have no idea how that could be implemented. A major desirable property of a good password hashing algorithm is that slightly differing inputs should produce wildly differing hashes, and the login authenticator should only ever know the password hash and not the password itself.

I know. I've being thinking about how to do it, currently it involves having N hashs where you generate them like:

  echo -n "password" | md5sum
  5f4dcc3b5aa765d61d8327deb882cf99  -
  echo -n "assword" | md5sum
  297dbe7699dcfa60609bf9e667e2e4dc  -
  echo -n "pssword" | md5sum
  537319a7934aea9825d1af85df588fde  -
  echo -n "pasword" | md5sum
  22e5ab5743ea52caf34abcc02c0f161d  -
  echo -n "pasword" | md5sum
  22e5ab5743ea52caf34abcc02c0f161d  -

ect, then check the submitted password by testing it against these hashes by removing characters in the same fashion.

Just as an early idea.

I think it's a good idea, what if you could encourage users to use stronger passwords by telling them that "the system will forgive near misses, so don't be afraid"?

Reply on news.ycombinator.com