Hi, folks. Re: random letters in passwords. I have a silly idea of storing salted hashes for all sequential combinations (of a given size) of characters from your password. So, for 4 random letters and a 10-letter password, I'd store (hashed and salted) {1-4}, {1,3-5} etc. No need for reversible encryption. Am possibly missing something...

@DeerHunter So for each password you'd store 5040 hashes.

@DeerHunter yes, you are. Brute forcing the hashes takes O(A^n) times where A is the alphabet size and n is the string length. You have n=4, which makes A^n small enough to quickly enumerate all possibilities.

@Gilles - thanks

@DeerHunter Continuing what @Gilles said. You'll also be identifying each "sub-hash" by something to tell you which combination that is (For example; 1st letter, 3rd letter, 9th letter, 10th letter). So you'll end up with 5040 plaintext sub-passwords with some formulas to come up with the full password.

@Adnan - agreed, this was a stupid idea.

@DeerHunter To be fair, this is how good ideas emerge.

@Adnan - nope. Only good fertilizer... :P

@Gilles - Would be interesting to learn whether such security tradeoff studies are actually done at real-life financial behemoths - "It would take a very thorough study of fraud and usability to assess quantatively whether using random characters from passwords for authentication is worth foregoing password hashing."

Okay, thanks everyone for hints, have to go. Bye.

theregister.co.uk/2013/01/28/exploit_kits_mine_old_vulns

"Cyber-crim toolkits love stinky old gaping holes"

@D3C4FF It's 02:47. I didn't need to sleep anyway.

Oh.. the image! The horror!

@Adnan Personally, i love all the holes.

As long as i get in there. Its all good

@D3C4FF but not "stinky old gaping holes"

@Adnan The older and stinkier, the tastier.

Its like cheese.