Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

McGill will double your password if you don’t do it first

mcgill.ca

Post reply on HN
Print view View original

11–20 of 152 posts

Re: McGill will double your password if you don’t do it first

#11

Post by wfjackson »

>The need to change passwords arose in April, when the Heartbleed vulnerability was revealed. Heartbleed makes systems vulnerable to data theft since attackers can use it to gain access to systems and then proceed to access and steal information without leaving a trace.

>Even though our central IT systems are protected against Heartbleed, any accounts that have already been stolen still pose a security risk. Almost 20,000 members of the McGill community did change their McGill Password, but thousands more did not, and so additional actions have become necessary.

So, ff the people who got the passwords read this post then all they need to do is double the passwords they got with HeartBleed to gain access?

Perhaps they should quadruple the password? /s

Re: McGill will double your password if you don’t do it first

#12

Post by penguat »

[deleted] wrote: post #8
hga wrote: post #6

Earlier quoted context omitted.

There are several ways this can be done without that. Easiest is if they store the date of the last password change or otherwise know you haven't changed it. If it's old enough, double the plaintext before handing it to the hashing function.

[deleted]

check that it's a string of the right form (e.g. it repeats something exactly twice) and then derive the original password from that, before feeding it to your hashing function.

Re: McGill will double your password if you don’t do it first

#13

Post by Cerium »

No, It does not mean that the password is stored as plaintext. Simply keep a flag for "UpdatedRecently?", if the flag is false, then not only should the first half of the input correctly match the hash, but the first half the input should match the second half.

Re: McGill will double your password if you don’t do it first

#14

Post by [deleted] »

[deleted] wrote: post #8
hga wrote: post #6

Earlier quoted context omitted.

There are several ways this can be done without that. Easiest is if they store the date of the last password change or otherwise know you haven't changed it. If it's old enough, double the plaintext before handing it to the hashing function.

[deleted]

[deleted]

Re: McGill will double your password if you don’t do it first

#15

Post by vertex-four »

[deleted] wrote: post #8
hga wrote: post #6

Earlier quoted context omitted.

There are several ways this can be done without that. Easiest is if they store the date of the last password change or otherwise know you haven't changed it. If it's old enough, double the plaintext before handing it to the hashing function.

[deleted]

If the database record says the user hasn't changed their password, split the given password in half, check that both halves are equal to each other, and check that one half matches the hash of the password.

Re: McGill will double your password if you don’t do it first

#17

Post by ChristianBundy »

Cerium wrote: post #13

No, It does not mean that the password is stored as plaintext. Simply keep a flag for "UpdatedRecently?", if the flag is false, then not only should the first half of the input correctly match the hash, but the first half the input should match the second half.

How is that helpful for mitigating security issues though?

Re: McGill will double your password if you don’t do it first

#19

Post by Nogwater »

rspeer wrote: post #9

The fact that they're able to "double your password" is a bad sign. Here's what this implies to me: * McGill had a database of everyone's password in plaintext at the time of Heartbleed * McGill is concerned about mitigating possible security compromises due to Heartbleed, including these plaintext passwords, which if they were compromised were compromised all at once * Despite this concern, McGill still has a databa…

I don't think that's necessarily true. Let's say they have all of the passwords stored as bcrypt hashes, and they also know the last time you changed your password. They could just update the application logic to check that your password is of the form if your last change date is before X. Then to check the password, they just take the first half and check that against the hash.
Post reply on HN