McGill will double your password if you don’t do it first
1–10 of 152 posts
Re: McGill will double your password if you don’t do it first
#2Is this effective at stopping attacks (given that it is public knowledge), or is it mostly a measure to annoy users into updating their passwords to something less cumbersome?
Re: McGill will double your password if you don’t do it first
#3Seemed like a good idea until it dawned on me that this means the passwords are stored as plaintext.
Re: McGill will double your password if you don’t do it first
#4This must be some security joke. I would worry more about passwords not being hashed than the fact that some users didn't change them.
Re: McGill will double your password if you don’t do it first
#5[deleted]
Re: McGill will double your password if you don’t do it first
#6Seemed like a good idea until it dawned on me that this means the passwords are stored as plaintext.
There are several ways this can be done without that.
Easiest is if they store the date of the last password change or otherwise know you haven't changed it. If it's old enough, double the plaintext before handing it to the hashing function.
Re: McGill will double your password if you don’t do it first
#7Seemed like a good idea until it dawned on me that this means the passwords are stored as plaintext.
[deleted]
Re: McGill will double your password if you don’t do it first
#8Seemed like a good idea until it dawned on me that this means the passwords are stored as plaintext.
There are several ways this can be done without that. Easiest is if they store the date of the last password change or otherwise know you haven't changed it. If it's old enough, double the plaintext before handing it to the hashing function.
[deleted]
Re: McGill will double your password if you don’t do it first
#9The fact that they're able to "double your password" is a bad sign. Here's what this implies to me:
* McGill had a database of everyone's password in plaintext at the time of Heartbleed
* McGill is concerned about mitigating possible security compromises due to Heartbleed, including these plaintext passwords, which if they were compromised were compromised all at once
* Despite this concern, McGill still has a database of everyone's password in plaintext. Oh, and a large proportion of them are still the possibly-compromised ones.
* They're comfortable announcing this fact to the Web, for some reason.
I really hope the first thing they do after doubling the password is put it into a password-hashing function and throw away the plaintext, and then make those users change them anyway, because the doubled passwords are still compromised. It sounds unlikely.
Re: McGill will double your password if you don’t do it first
#10Seemed like a good idea until it dawned on me that this means the passwords are stored as plaintext.
There are several ways this can be done without that. Easiest is if they store the date of the last password change or otherwise know you haven't changed it. If it's old enough, double the plaintext before handing it to the hashing function.
>> Seemed like a good idea until it dawned on me that this means the passwords are stored as plaintext.
>There are several ways this can be done without that.
>Easiest is if they store the date of the last password change or otherwise know you haven't changed it. If it's old enough, double the plaintext before handing it to the hashing function.
Not quite. What you'd need to do is halve the user's entered password if it's older than the cutoff date. If the user enters "foobarfoobar" then you'd halve it to "foobar" before hashing and comparing it to what's stored.
If you only have the old hashed password stored then you don't have the hash of the doubled password, nor can you can infer it.
This whole approach is silly of course. They should just force everybody to reset their passwords.