Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The released passwords are hashed with SHA1. Assuming you use the same algorithm and linkedin does not use a salt (they probably do), then you could just compare the hashes.


LinkedIn passwords are not salted. You can only make comparisons if your database contains unsalted passwords. And if both databases used salted-passwords, then you still can't compare unless you all shared the same salting key.


You can't compare the hashes unless you have access to the clear passwords of your users. Unless you mean to do the comparison just as they log in. Seems like a lot of hassle for not much though.


Or do it the next time they log in, when you temporarily have their cleartext password.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: