Hacker News new | ask | show | jobs
by elwell 4415 days ago
Or you map them to something like:

Q = ABDHCJSKJDHSSS

Z = YYYDUHUHUHSSYS

... to avoid weakening the password.

2 comments

I can't tell if you're joking or not, but for the benefit of people who don't know any better: such a scheme would not meaningfully impact the strength of the password storage scheme at all. (To prove it to yourself, think about how rainbow tables work. Then consider how little additional work would be required to replace all Q's and Z's with the appropriate string before making the table. It's not much different from having a "salt" that's the same for every user in your application, which also doesn't meaningfully impact the strength of the password storage scheme.)
Actually, it's a classic case of security through obscurity. If the attacker doesn't know about it and are using a standard rainbow table, then no, it's not going to have "ABDHCJSKJDHSSS" in there and it will make their life harder. Once they do find out, though, it's useless.
Or just map them to asterisks, and call it a hunter2 transform...

"Cannot contain special characters or symbols (such as !#$@*, etc)"

Well, damn! Guess that won't work.