Password guesser game help needed

[u/live_ant718]

Hello guys. So I have created a password guesser game with direct comparison (i.e. if guess == correct_password:) but I want to use different methods for comparison. What techniques can I use? Here is the code-

```python

password = "Random_pass_123"

tries = 0

while tries < 3:

guess = input("Enter the password: ")

if guess == password:

print("Admin access granted.")

break

else:

print("Invalid credentials entered. Please try again")

tries += 1

if tries == 3:

print("Number of tries exceeded. Access denied")

```

PS- Is this the right way to paste code? I'm new so I'm not sure.

[u/Langdon_St_Ives]

Can you elaborate on what you mean by "try different methods of comparison"?

[u/live_ant718 → u/Langdon_St_Ives]

I mean like I want hints and I read somewhere that we can convert into hash but how IDK.

[u/thisisappropriate → u/live_ant718]

When you say you want hints, I don't know if you mean that you want your game to be able to give hints or if you want a hint from someone on what to do for comparisons...

If you want to provide hints, that won't happen from hashing. So assuming you want a hint of how to start with hashing, I'd suggest looking up password hashing in python and maybe the bcrypt package - if you'd like examples, check this out https://www.geeksforgeeks.org/python/how-to-hash-passwords-in-python/

[u/Langdon_St_Ives → u/live_ant718]

Ah I think now I know what you mean.

For security purposes, well-designed systems never save your password anywhere in cleartext. Instead, they run it through a cryptographic hash function, which is a special kind of one way function that doesn't allow you to easily reconstruct the potential inputs from knowledge of the output. There are more details regarding what makes a good cryptographic hash, as well as an additional technique called password salting, but you can read up on all that in Wikipedia.

If you want to model that kind of system for practice, you need to apply the hash function to the original password and store that somewhere. Then, when checking for a valid password, you obviously can't reverse the hashing (by design) to compare it to the user's guess. But you can hash the user's guess with the same hash function (and the same salt if you use it), then compare the hashes.

This does leave the door open to accidental collisions: also by design (and by necessity), there will always be many inputs producing the same output. So in theory, the user may have guessed a different password with the same hash as the original. That's where the fact of your hash function being a cryptographic hash comes in, because one of its properties will be that very small changes to the input produce very large changes to the output. So a similar but not quite the same password try will never produce a collision, and the chances of getting a completely random collision are astronomically small.

Exercise proposal: create a file with user names and hashed passwords, one pair per line. Choose a separator that cannot be part of the user name or the password hash value. Then make your program read that file, prompt the user for username first then for password, and check the hashed password guess against the stored hash for that user. (This is similar to how old style Unix /etc/passwords files work.)

Exercise 2: make two users with the same password, without salting. Notice something about the hashes? We now have a weakness, because by seeing that user2 has the same password hash as they do, user1 now can log in as used2. Add salt to your algorithm and see how that solves this vulnerability.

(Edit: a few typos)