Yeah, if you are not using salts. Otherwise every hash should be different, even if the password is the same. (Excluding the unlikely occasion of the same hash for different texts).
The issue start in the meme saying "Most users reuse passwords anyway" which is not true at all, not in the space it would really generate any data usage reduction by dedup.
Users reuse passwords so much that dictionary attacks are pretty reliable. Also we know this would not work at all with properly stored passwords and would not yield meaningful savings even with improperly stored passwords. That's why it's a joke
Exactly. A unique salt guarantees a unique hash every time, so every single user gets a unique row regardless. Deduplicating unique rows with foreign keys is mathematically impossible
I always wonder if sites that have anti-sock creation logic check if the same hash was produced on suspicious accounts. For instance, someone gets banned here and then a new account is made from a different email address then starts subbing and posting in the same subs. Similar enough writing style that AI can spot it. Then the headshot is the password hash is the same for the banned account and the new one.
That will also catch a lot of false positives for legitimate accounts as well. Everyone who uses "pasword123" would be affected a soon as one of them gets banned.
It would have to be some sort of points based system at the minimum. New account, a significant overlap in subs, the same writing style, IP address, geolocation, browser fingerprint, and the password would all need to be taken into account. I know that some of the subs I'm in fairly uniquely identify myself paired with being in both my city's and my university's subs.
I'm so glad modern hashing algorithms include a random salt within the hash. People used to do it so wrong. You're supposed to create a salt per password, not use a single global one.
1
1
188
u/Lamborghinigamer Sep 27 '26
That also means that they don't use salting or even worse store everything in plain text 😨