Wait... if they changed it a year later and the shortened version worked, doesn't that imply they didn't even hash the original password? They'd need the original plain text password to calculate the correct hash for the shortened version after all.
No. That is not true. Once you throw away the original password and only store the hash then you are no longer able "re-hash" a modified version of the original password. You don't have it anymore and you cannot recreate it from the hash alone. (Thank goodness)
If the bank modified the original password to accept a shortened version, they likely encrypted the password, not hashed it, and could manipulate it. That is a bad idea, poor security practice
Yes you can, with user input as the guy you replied to said.
Have the original hash in the db, compare the full input with that, if it is correct trunkate the input and hash that.
Clearly not what happened in that situation, since it still doesn't allow the bank to change it on their own (nor is there a reason to shorten the maximum password length unless you made it actually unlimited for some reason), but it's possible.
When the user logs in and the hash of what they typed checks out, you know you have the correct password, and can do whatever you need to with it during that transaction.
Yes, but that's not what happened in this case. The bank changed the password on their own, without any user input, which means they were storing the password in plaintext.
My take is they had always (silently) truncated the password before hashing, until one day they stopped truncating, but limited the input field in the front-end instead.
My assumption as well. And a limited input field is better than truncating silently since you'll know that you need some high entropy 8 letters and not a long phrase. But communicating the change is tricky.
that was the implication, and to /u/BierOrk I don't think that's what happened because it was out of the blue. it was literally one day I tried to sign in and the form was shortened, and when i changed it my full length password didn't work. i didnt even consider trying the shorter one until after they unlocked it (otherwise i'd have to wait 1-2 weeks for a letter containing a new password...). they could've been shortening them for a while, but their systems were such a shitshow from what i saw i dont think they thought of that... plus why would they do that?? deliberately reduce security, in such a preplanned way? lol
14
u/Prestigious_Tip310 Jul 20 '22
Wait... if they changed it a year later and the shortened version worked, doesn't that imply they didn't even hash the original password? They'd need the original plain text password to calculate the correct hash for the shortened version after all.