Damus
note1u2ljs...
Soatok Dreamseeker ๐Ÿ”œ DEFCON 34 profile picture
If anyone is confused about why this is funny:

Imagine you have two password fields on two different forms

Form A uses a password hashing function (e.g., Argon2) on your password and stores a hash.

Form B is almost the same, but hashes the string "gay" followed by your password.

If you swap hashes, you only need to prepend "gay" to your usual password for it to succeed.

Okay, so what?

Now imagine you're building a protocol that uses hash functions for different purposes and you used H(m) and H("gay" + m) in two different places, and felt confident that swapping hashes would always fail.

Well.

Bad news lol
1
cliffle · 6w
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq0mwq9c623ujjzpql7r4fk090yxrf458sz2egzprw0zn0ca669q9q3rs8xx oh man, remember how much of a pain it is when you come out and now you have to change all of your passwords to start with "gay?" Thank goodness the kids these days have password manag...