Post #3759383

Extrapolating from a couple of interesting recent Discord threads about whether laws like GDPR could compel an operator to reveal an individual's password hash ... If unsalted, the responding org might be resistant to revealing that the hash is unsalted (and therefore weak), which it could be argued would be security by obscurity that a regulator might reject (if they were aware of the nuance), and therefore unjustified Even if salted, divulging the hash doesn't reveal anything to the user that they don't already know from the perspective of the password itself, but an unauthorized request to disclose would produce a hash that could then be cracked, putting the user at risk (which could be an argument to refuse all requests?) " If a pepper was used, refusal seems clearly justified because it could put all users at risk if hashes were leaked later And there's some interesting UK ICO coverage of best practices (for authentication generally and passwords specifically) here, that I hadn't seen before: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/passwords-in-online-services/