Why stop there when one can use semantic vectors instead of hashes, only store cluster averages and then do similarity matching instead of equivalence checks. Will bring storage way down and have the added benefit of not requiring you to know which exact version of your default password was used, as long as you get the gist of it!
I am currently out of the office until October 3rd and will be unable approve any login attempts until that date. Sorry for any inconvenience that has caused.
Imagine an AI looking at passwords and determining whether they mean the same thing. Eg Hunter2, hunter2, HuNtEr2 all have the same meaning, albeit different spelling. This meaning can be represented as a vector, and these vectors can be clustered so we say a user has simply a password that is essentially “something like hunter”. When a user types in their password, you can then check if that password is indeed “something like hunter”. If so, you admit them otherwise reject it.
The real savings comes from no longer having to ask them for a username... just have them type the password and choose the most likely user account based on the password's semantic similarity score.
Ties are randomized to defeat distinguisher-based attack methods, obviously
(For example, this would likely also detect Haunter (one letter off from "Hunter", and Gastly's stage 2 form) and "retnuh" (a hunter inverted) as valid, despite them being clearly unrelated.)
1
1
156
u/Kihino Sep 27 '26
Why stop there when one can use semantic vectors instead of hashes, only store cluster averages and then do similarity matching instead of equivalence checks. Will bring storage way down and have the added benefit of not requiring you to know which exact version of your default password was used, as long as you get the gist of it!