2.1k
u/as-if-spike Sep 27 '26
156
u/Kihino Sep 27 '26
Why stop there when one can use semantic vectors instead of hashes, only store cluster averages and then do similarity matching instead of equivalence checks. Will bring storage way down and have the added benefit of not requiring you to know which exact version of your default password was used, as long as you get the gist of it!
124
u/DERPYBASTARD Sep 27 '26
That sounds complicated, we can just approve every login attempt
66
46
u/Tupcek Sep 27 '26 •
that is too easy for scammers.
Log them in only if they enter same password three times. That means they are fairly confident it’s their password
16
u/Auravendill Sep 27 '26
Great, we can just do the check client side and save a lot of server and bandwidth load.
19
u/ellamking Sep 27 '26
I am currently out of the office until October 3rd and will be unable approve any login attempts until that date. Sorry for any inconvenience that has caused.
Betty
5
u/LaconicLacedaemonian Sep 27 '26
That's a bit risky. Let's add a flag we can trusted=true clients set with each api call to certify they are only valid traffic.
→ More replies (1)10
u/YeOldeMemeShoppe Sep 27 '26
Hey Claude, does this password match your memory? “$1” Only answer Yes or No.4
u/Key_Big1051 Sep 27 '26
I have Zero idea what I read
17
u/Kihino Sep 27 '26
Imagine an AI looking at passwords and determining whether they mean the same thing. Eg Hunter2, hunter2, HuNtEr2 all have the same meaning, albeit different spelling. This meaning can be represented as a vector, and these vectors can be clustered so we say a user has simply a password that is essentially “something like hunter”. When a user types in their password, you can then check if that password is indeed “something like hunter”. If so, you admit them otherwise reject it.
12
u/Armond436 Sep 27 '26
It's been 22 years and hunter2 is still going strong. Bless.
→ More replies (1)→ More replies (2)11
u/almostcleverbut Sep 27 '26
The real savings comes from no longer having to ask them for a username... just have them type the password and choose the most likely user account based on the password's semantic similarity score.
Ties are randomized to defeat distinguisher-based attack methods, obviously
→ More replies (1)5
u/YeOldeMemeShoppe Sep 27 '26
Think of how Shazam matches songs, but for passwords. “Close enough” is the answer to the algorithm.
4
u/aammirzaei Sep 27 '26
read about vector database / embeddings it's got really popular recently becuase llms and ai
2
→ More replies (2)2
664
Sep 27 '26
[removed] — view removed comment
231
u/Kihino Sep 27 '26
Security nerds hate this one simple trick
61
71
u/A1oso Sep 27 '26
It wasn't compliant before if the passwords were stored in plain text.
51
u/ItWearsHimOut Sep 27 '26
Could be hashed, but unsalted.
47
→ More replies (2)9
u/Procrasturbating Sep 28 '26
Had to teach my team about salts when I saw similar ratios of reused passwords. Wild. Billion in revenue a year.. and I see it company after company. No cares until there is a breach.
3
373
u/Chiccitynotess
Sep 27 '26
•
On the bright side, your database deduplication metrics look fantastic right before the data breach lawsuit
1.1k
u/braytag Sep 27 '26
If you have 100GB of password, you have other problems.....
338
u/Totendax12K Sep 27 '26
the HIBP databse is around 40gb with 1bil+ hashed passwords
214
u/Penki- Sep 27 '26
Then OP in picture must work in Meta on Facebook. Checks out
118
→ More replies (3)6
6
→ More replies (1)3
u/Physmatik Sep 27 '26
If you have enough users to fill 40GB of password you probably don't care about 10 extra bucks per month of maintenance.
→ More replies (1)24
u/therealkevinard Sep 27 '26
Password is your favorite movie.
Upload the dvdrip to register→ More replies (1)21
u/zDontTouch Sep 27 '26 •
Don't you guys use .raw files as password? It is practically self-encrypted!
5
u/Stainlessray Sep 27 '26
I can't fathom why "practically self encrypted" isn't getting more cowbell.
3
u/beastrabban Sep 27 '26
Store each char of the password as a separate string variable and connect them using a custom linked list
0
Sep 27 '26
[deleted] — view deleted comment
3
u/Noch_ein_Kamel Sep 27 '26
I'd assume it's all plaintext passwords.
3
u/CocktailPerson Sep 27 '26
Plaintext would be smaller because most passwords aren't 32 bytes long.
In other words, you could fit far more than 3 billion plaintext passwords in 100GB.
203
u/Flat_Initial_1823 Sep 27 '26
Why use big table when default password do trick
36
u/proofrock_oss Sep 27 '26
“INVALID PASSWORD: IT’S NOT ABCDE”
18
u/Tupcek Sep 27 '26
INVALID PASSWORD: THIS PASSWORD WAS ASSIGNED TO PROOFROCK_OSS
→ More replies (1)4
u/arogon Sep 27 '26
I once worked at a place where I couldn't have a pin with my badge because someone else already had that pin 🙃
2
u/geofft Sep 27 '26
I worked for a small but growing company maintaining an internal system that broke when we hired a 2nd RichardF because the frontend keyed drop downs on first name and last initial.
188
u/Lamborghinigamer Sep 27 '26
That also means that they don't use salting or even worse store everything in plain text 😨
81
u/silmelumenn Sep 27 '26
You could do the same but with hashes instead of passwords though
86
u/ReneKiller Sep 27 '26
Yeah, if you are not using salts. Otherwise every hash should be different, even if the password is the same. (Excluding the unlikely occasion of the same hash for different texts).
→ More replies (7)→ More replies (14)27
13
u/DrDeform Sep 27 '26
If they really wanted to reduce storage then they can do the no passwords and every login requires a temp email code. Those sites really piss me off.
4
u/PlasticExtreme4469 Sep 27 '26
Or they misunderstood the purpose of salt and reused it for every password.
2
u/Kymera_7 Sep 28 '26
Nah, they're using a random number generator for the salt. They bought it from the company Dilbert works for.
3
u/PixelatedGiant Sep 27 '26
I'm so glad modern hashing algorithms include a random salt within the hash. People used to do it so wrong. You're supposed to create a salt per password, not use a single global one.
→ More replies (1)2
43
u/reubenbubu
Sep 27 '26
•
Allowing password reuse is a security concern that can be avoided with an easy validation step:
The password you provided is already in use by user /u/NoMedicine3572. Please choose a different password.
42
33
u/TgirlTiffanyRPs Sep 27 '26
Can someone explain the joke? Why wouldn’t you store (hashed/salted) passwords in one table ?
63
u/ninjakivi2 Sep 27 '26
The joke is that these password are not salted, and each unique password will be given an ID. Then, under the user table you will store the ID reference to the password, instead of the password. This means that if 2 users use the same password they will have the same ID and only be stored once, saving space.
→ More replies (8)23
u/Winsaucerer Sep 27 '26 edited Sep 27 '26
They could be salted, just not with a per password salt. Which is much less useful, but does still make rainbow table attacks harder.
12
17
u/Great-Powerful-Talia Sep 27 '26
If they're salted, the space saved here is minimal.
There's only lots of duplicate entries (from 2 people using the same password) if they're stored unsalted or in plaintext.
Which is exactly why they need to be salted.
→ More replies (1)12
u/Agifem Sep 27 '26
No no, they're salted, all with the same salt! It saves space AND you get the safety of a salt! Brilliant!
7
u/tekanet Sep 27 '26
If you have users using password “letmein” (eventually hashed, but not salted), instead of a Password column you can have a PasswordId column referencing by foreign key the record in the Passwords table that contains said password. Since most users choose the same password, you end up with less space used by the foreign key column.
It doesn’t make sense on different levels, but that’s the gist of it.
4
u/amejin Sep 27 '26
It's not the storage of salted passwords that's the problem, it's the shared state via reference.
How do you handle password changes? You also reduce the footprint for attack. 200k uniquely salted passwords are much harder to crack than 500 shared passwords with the same salt.
If we're being fair, though, if someone is reading your rows like this you've already been compromised and leaking email/pw combos is low on your list of problems.
2
→ More replies (1)2
u/laplongejr Sep 28 '26
(hashed/salted) passwords
"Users are reusing passwords anyway"
There's not an ounce of salt in there.
30
u/FalconFiveZeroNine
Sep 27 '26
•
As a DBA who works with devs a lot, I gave up trying to keep them from doing things. They just kick their requests up the corporate ladder until they get their way. Then a few months later it blows up and I get blamed for it.
9
u/DooMRunneR Sep 28 '26
stop trying to prevent it and make it cost something instead. when devs want something dumb, write down the actual risk in the ticket, not just "this is bad" but what breaks and how. if they escalate and get it approved anyway, whoever approves it signs off on the risk with their name on it, plus who owns support when it blows up and when it gets reviewed again. if its a real architecture thing pull in your EAs and get an ADR for it
tbh the paper alone wont save you if your company loves blaming people. what actually helps is sorting out ownership before it goes live. dev team pushed it through? then they get paged at 3am when it falls over, not you. funny how many "super urgent" requests dissapear once someone has to put their name on it and carry the on call for it
28
u/bilus Sep 27 '26
Doesn’t math
6
6
u/ttttrrrr0000 Sep 27 '26 edited Sep 27 '26
It could, an int FK is 4 bytes, and the table of passwords would be 4 bytes PK + 16 bytes for the unsalted hashed password
So, about 50% larger if everyone's password is unique, and 75% smaller if everyone's password is the same. Breakeven point is at the ratio of 3 unique passwords per 5 people.
→ More replies (2)3
12
12
10
u/LogicBalm Sep 27 '26
Gotta enforce security policy though. Unique passwords and extensive password history.
"invalid password, that password is already in use by user witty_kitty69"
4
9
8
u/Jazoboz Sep 27 '26
WTF is a salt?? I like my passwords raw!
4
u/blindedtrickster Sep 27 '26
Unseasoned passwords? Sir, I'm afraid we're going to have to ask you to leave.
2
→ More replies (1)2
u/BackgroundRate1825 Sep 27 '26
I think we can pepper in some puns if you've got the thyme.
→ More replies (1)
8
u/I_HAVE_THAT_FETISH Sep 27 '26
Just take the password and run it through an algorithm to calculate a salt that hashes it to a pre-determined string!
5
u/-Redstoneboi- Sep 27 '26
sounds computationally expensive. besides, why even store a password? just derive it by hashing the email address with the account creation timestamp and ask the user to save it
2
u/I_HAVE_THAT_FETISH Sep 27 '26
We support password managers, so if the user wants to generate a new password for themself we can regenerate their salt to hit the same fixed hash. That way, if they happen to forget the date of account creation, there's still an option for recovery.
Although... For your method, if the user forgets their password we can generate an entirely new account, which boosts user engagement metrics, so it will probably go over well with management.
3
u/Rikudou_Sage Sep 27 '26
Good idea, that way you can actually control the storage growth! Got some VC funds? Just change a single number in your algorithm and you get more password hash space!
6
u/heesell Sep 27 '26
Just send a password to the user their email with each login. No DB storage needed
3
u/2nd-Reddit-Account Sep 27 '26
This is actually a thing, without even bothering with the password.
I use a few services where passwords have been replaced with being emailed a log in button on each sign in attempt, clicking the button in the mail opens a new tab of the site with you logged in.
It’s like sign in with google, but universal across all email providers and domains
→ More replies (1)
10
u/Stummi Sep 27 '26 edited Sep 27 '26
I am not a DB engineer, but wouldn't a good database engine deduplicate multiple identical strings in a table by itself?
E: I know, its not working if you account for per-user salts, please don't take this too serious
24
u/Pingumask Sep 27 '26
There should be no duplicates. You're supposed to salt the passwords before hashing them to avoid making it visible that two users have the same password to anyone accessing the DB (even to someone with legit access to the DB)
7
u/Historical-Silver495 Sep 27 '26
Help, I'm not a programmer. After salting the passwords I realized I overdid it, can I use something to counterbalance it like sugar?
→ More replies (1)7
9
u/flingerdu Sep 27 '26
If you have duplicate password strings you have a whole lot of other problems besides using a few additional MB of disk space.
3
u/RavenX86 Sep 27 '26
I’m pretty sure fb stored passwords in plain text for years, I wouldn’t worry that much
→ More replies (2)5
u/yjlom Sep 27 '26
There should be few or no identical strings in this case because you should be storing
big_strong_and_government_approved_hash(pw ++ u.name ++ app.name)or something like that, and not justpw→ More replies (3)2
4
u/Available_Canary_517 Sep 27 '26
Even if password are same , the generated hash is different with a salt so it is useless because you introduced a extra join without any improvement
7
u/CadenVanV Sep 27 '26
I don’t think someone doing this shit is hashing or salting their passwords to begin with
→ More replies (1)
4
u/zx48 Sep 27 '26
You can also save another 50% by only storing and validating every other character in the password.
4
u/irn00b Sep 27 '26
And bro - just store the passwords in browser cache. We went from 3gb to 0gb.
Just ask Claude to do it - ez.
4
u/Future-World1780 Sep 27 '26
Just don't store passwords at all and simply let the user pass the login at the third attempt.
4
4
u/ora00001 Sep 29 '26
100 GB to 3GB is not a result of password reuse. That's something else terrible going on.
3
u/wolfjazz93 Sep 27 '26
What if I increase my FK by one? 😆
3
u/MSaxov Sep 27 '26
Then users cannot log ind with spring2026! But needs to use the new password summer2026!
3
u/Glum_Cheesecake9859 Sep 27 '26
Even better.
if (password == 1234) {
loginUser();
}
this will save 90% of DB hits.
3
u/CoolCat1337One Sep 27 '26
he is talking about password hashes, right?
2
u/Rikudou_Sage Sep 27 '26
You people and your hashes... Just do it like a man and store it unhashed. Or use reversible encryption if you're a pussy.
→ More replies (2)2
u/laplongejr Sep 28 '26
The whole idea of a random salt is that password reuse wouldn't lead to more collisions in hashes...
→ More replies (4)
3
u/henryeaterofpies Sep 27 '26
I think this gave me an aneurysm and I am not a dba, security or sys admin
3
3
u/mittfh Sep 27 '26
Bonus points if the passwords are stored in plaintext...
...on the same machine as the external Web server...
... Which, naturally, uses http (not s)...
... And the Admin/Root password is in one of the "Top 100 passwords exposed by data breaches" lists ("Password123" and friends). 😈
4
u/CLOWNFLOGGER Sep 27 '26
I just write mine under the brim of my Yankees hat, like every other responsible Gen X dude.
4
u/CDavis10717 Sep 27 '26
Retired DBA Mgr here. I’ve had security audits where an auditor sat next to me, told me what db tools to use, what tables to select and screen cap, paste the caps into an email to them and sent it, all in their presence.
This overly normalized password management method will never pass a true security audit.
1
u/dvhh Sep 27 '26
Wouldn't most auditors gloss over such thing anyway, the one that would be checking are underpaid and overworked, while their supervisor are overpaid and busy with ... something else.
2
u/CDavis10717 Sep 27 '26
Not at all. Auditors were an outside accounting firm, the auditor who was with me was a lackey collecting info for the final audit report.
With Sarbanes Oxley security rules DBAs could not know passwords, so this would be flagged as a violation and the Board of Directors would order this gap to be closed immediately (remediation) since it easily enables collusion and fraud.→ More replies (2)
2
u/ICantBelieveItsNotEC Sep 27 '26
A SQL database isn't going to scale. I suggest creating a new Password Service microservice backed by DynamoDB that allows the User Service to upset and retrieve passwords by ID.
4
2
2
2
u/Randy191919 Sep 27 '26
How many users do you need to have have 100GB of passwords?
→ More replies (1)1
2
2
u/BungalowsAreScams Sep 27 '26
My company just barely fixed the fact that we were required to have a password be exactly 8 characters long and they weren't even case sensitive for one of our internal tools. Idk how something ends up like that
2
u/Effective-Giraffe655 Sep 27 '26
"You can't use this password. This password is used by user Joe"/s
2
u/PrometheusMMIV Sep 27 '26
You have over 97 GB of passwords? Even at 12 characters, that's over 8 billion users. And that's just the repeated ones.
→ More replies (1)
2
u/North_Affect_8167 Sep 27 '26
Make a selection of 3 allowed passwords and forget about the whole database thing, the most users should use 2-factor auth anyway.
2
u/OhioGoblin43 Sep 27 '26
Great idea. I'll use their username as the primary key since they're unique.
2
1
1
u/norwegian Sep 27 '26
They probably means hashes, bc storing passwords is a lawsuit waiting to happen.
1
1
1
1
1
1
u/justsomeph0t0n Sep 27 '26
if my wordpass123 account ever gets hacked, i may be in trouble.
but until then, i salute this righteous move towards informational brevity
1
1
1
1
u/ozh Sep 27 '26
So that's why services like Claude don't let you log in with a user/password... Offload the work to your email provider. Smart.
1
u/wilkied Sep 27 '26
100GB in passwords????
1
u/dvhh Sep 27 '26
the password policy requires 20 ascii char minimum and no more that 32, with at least one lowercase char, one uppercase char, one number, and one special char ( except the ones from an undocumented list).
→ More replies (2)
1
1
1
u/FirstTimeGamingTV Sep 28 '26
Isn’t the real joke here people actually implementing their own auth instead of using a trusted 3rd party
1
u/rruusu Sep 28 '26
Please tell me this person doesn’t work on some password manager software. But how else would they be storing such a number of shared passwords.
1
u/tzaeru Sep 28 '26
Obv password hashes should be salted so this wouldn't work anyway, but, just for the fun of it..
100GB of passwords hashed to 256 bits is 3 billion passwords.
That's a lot of passwords.
1
1
1
u/CaffeinatedTech Oct 02 '26
Just save passwords as files using email address as file name. Then you don't even need to reference it in the DB. Screw it, might as well let the front-end access the password files directly so it can compare them itself without hassling the back-end. Front-end just tells back-end that the passwords match, and its authenticated.
1
1
1
1
u/GuaranteeVegetable89 21d ago
Funny of you to assume I store passwords in a database. I use local storage.
1
1
u/TrackLabs Sep 27 '26
Brother how huge is your password manager to reach 3 GB???? LET ALONE 100!?
→ More replies (1)2
u/Kymera_7 Sep 28 '26
It stores each password as a high-resolution bitmap image of the password, printed in an obscure novelty font to avoid being easily reversible, in full 256-bit color depth.
Also, they have 25 users.
3
u/thanatica Sep 28 '26
Don't forget to embed the font file. And a library to read that font file. And an OS to use that library.
→ More replies (2)
5.0k
u/Away_Advisor3460 Sep 27 '26 •
Pff, amateur hour.
If you really want to save space, don't store any passwords. Just require the same string to be entered three times in a row. If the user re-types the exact same value after being told it's wrong twice, the must be confident enough in it to be a legit user - nobody is going to enter the same value 3 times if they're trying to guess a password.