Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

McGill will double your password if you don’t do it first

mcgill.ca

Post reply on HN
Print view View original

41–50 of 152 posts

Re: McGill will double your password if you don’t do it first

#41

Post by bengali3 »

temuze wrote: post #31
rspeer wrote: post #9

The fact that they're able to "double your password" is a bad sign. Here's what this implies to me: * McGill had a database of everyone's password in plaintext at the time of Heartbleed * McGill is concerned about mitigating possible security compromises due to Heartbleed, including these plaintext passwords, which if they were compromised were compromised all at once * Despite this concern, McGill still has a databa…

Theoretically, they could have HAD the password in plaintext, then doubled it, salted it and hashed it in the new DB.

this makes sense, as they also doubled(+2) the min password lengths. 18 char would be rather annoying to me though.

Re: McGill will double your password if you don’t do it first

#42

Post by Dylan16807 »

[deleted] wrote: post #40
Nogwater wrote: post #19

Earlier quoted context omitted.

I don't think that's necessarily true. Let's say they have all of the passwords stored as bcrypt hashes, and they also know the last time you changed your password. They could just update the application logic to check that your password is of the form if your last change date is before X. Then to check the password, they just take the first half and check that against the hash.

[deleted]

Doubling doesn't provide a benefit, no matter how well they hash or don't hash.

Re: McGill will double your password if you don’t do it first

#43

Post by geofft »

I think that the goal here is not to increase password strength, but to make typing your old, short password so annoying that you pick a different one (that complies with the current password strength rules). That is, this isn't aimed at attackers; it's aimed at users.

If so, it's pretty clever.

Re: McGill will double your password if you don’t do it first

#44

Post by Aldo_MX »

Nogwater wrote: post #19
rspeer wrote: post #9

The fact that they're able to "double your password" is a bad sign. Here's what this implies to me: * McGill had a database of everyone's password in plaintext at the time of Heartbleed * McGill is concerned about mitigating possible security compromises due to Heartbleed, including these plaintext passwords, which if they were compromised were compromised all at once * Despite this concern, McGill still has a databa…

I don't think that's necessarily true. Let's say they have all of the passwords stored as bcrypt hashes, and they also know the last time you changed your password. They could just update the application logic to check that your password is of the form if your last change date is before X. Then to check the password, they just take the first half and check that against the hash.

  "password123password123".match(/^(.+)\1$/)[1]

Re: McGill will double your password if you don’t do it first

#45

Post by abritishguy »

geofft wrote: post #43

I think that the goal here is not to increase password strength, but to make typing your old, short password so annoying that you pick a different one (that complies with the current password strength rules). That is, this isn't aimed at attackers; it's aimed at users. If so, it's pretty clever.

Then why not just force them to change the password on login?

Re: McGill will double your password if you don’t do it first

#47

Post by eksith » 

  The McGill Password length has also been increased from exactly eight 
  characters to a variable length of eight to 18 characters.
So they're not using bcrypt (usable length 72). Even PBKDF2 would have been acceptable, but my guess is that they were sold a "layer over" on their stack with this. I can already tell this is a hacky patch.

  Every year, about 1,200 to 1,500 McGill accounts are compromised in 
  one way or another.
Phishing + guessing. I know someone who gets about 2-3 emails a week asking to enter their login info into some site in Brazil or the Czech Republic.

If every site properly salted and hashed passwords, reuse isn't even a problem. But as we know :

  - Most people choose crappy passwords.
  - Most sites use crappy hashing schemes (if they hash at all)
When other sites are compromised, there's an easy list of ready passwords to try against other potential targets.

McGill's problem isn't Heartbleed.

Re: McGill will double your password if you don’t do it first

#48

Post by Aldo_MX »

Dylan16807 wrote: post #42
[deleted] wrote: post #40

Earlier quoted context omitted.

[deleted]

Doubling doesn't provide a benefit, no matter how well they hash or don't hash.

Whether it provides a benefit or not is unrelated to the fact that they don't need to know your plaintext password to use something like the regex I wrote to detect a string duplicated twice and extract the first match prior to hashing/checking against the DB.

Re: McGill will double your password if you don’t do it first

#50

Post by [deleted] »

Dylan16807 wrote: post #34
rspeer wrote: post #9

The fact that they're able to "double your password" is a bad sign. Here's what this implies to me: * McGill had a database of everyone's password in plaintext at the time of Heartbleed * McGill is concerned about mitigating possible security compromises due to Heartbleed, including these plaintext passwords, which if they were compromised were compromised all at once * Despite this concern, McGill still has a databa…

They can put a flag on the database and check that the cleartext you send them when logging in is doubled before hashing half of it. I can't count how many times I've seen something that could easily be done at login time and people conclude that the service must be storing plaintext or multiple hashes. This isn't even a direct security measure in the first place. This is to annoy people into updating their passwords…

[deleted]
Post reply on HN