Record more things on various login attempts #5344
Conversation
app/Models/LoginAttempt.php
Outdated
| // The goal is just to allow vaguely matching password - for | ||
| // example when trying same password - to be excluded from being | ||
| // counted as additional attempt. | ||
| return substr(sha1('osu_unique_'.md5($password)), 8, 12); |
There was a problem hiding this comment.
But vaguely matching passwords would result in completely different hashes..?
There was a problem hiding this comment.
as in there might be another password resulting same "hash"
There was a problem hiding this comment.
Only same password and collisions would result in the same result, and the collisions won't even be from similar values since the password is being hashed? The chance of a vaguely matching password returning the same result might as well be non-existent
There was a problem hiding this comment.
it's not "vaguely matching password" but "vaguely matching" password (as in just because it matches doesn't mean it's the same) 💃
There was a problem hiding this comment.
it's not allowing anything then ಠ_ಠ
notbakaneko
left a comment
There was a problem hiding this comment.
Is it intentional for non-existent users to match the same record?
That was weird. Slightly lenient password match check.