Hacker News new | ask | show | jobs
by ledude 3661 days ago
just a random tidbit.. but the system currently allows you to set your password to what you previously had
1 comments

I actually hope this is true as a consequence of them storing salted hashes for passwords. That is, Github should not ever see my password, only validate that I know what I entered previously.
It's pretty easy to keep a list of old salted hashes, and copmare the new password's salted hash against the previous ones. It doesn't require saving the old passwords.
If the salt changes, you'd need to compute the password using multiple salts, which might have crypto guarantee issues when sent to the server.
I don't follow what you're saying.

To compare your new password with your old password, you take the old salt, hash your new password together with it, and compare the result to the old hash. If they match, you're trying to reuse the same password. You do this on the server side, naturally.

If everything is done server side, sure.
Why wouldn't it be?

If salted hashing were done on the client side, it means you're actually sending username + saltedhash, instead of username + password to the server to log in.

So an attacker could submit a precomputed or stolen salted hash to be compared against the stored one -- completely defeating the point of hashing passwords in the first place.

I'm not following that logic. Using salted password hashing would not prevent them from checking your new password against the previous hash.