Agreed the whole "whitelisting" tripcodes sounds fishy, and I wonder why there is no explanation of what or how that was done. However, if I was developing something like that then I would:
Have the whitelist of trip codes
Have the salt and list of previous salts
Hash the password with salt, and previous salts
See if any of those resulted in a hash that is whitelisted
If so use that one. Otherwise use the one with the newest salt.
Doing a hash is not exactly computationally expensive, you can generate thousands a second on old hardware so I would not see an issue doing this with every tripcode ever posted.
Edit: also entirely possible to check a tripcode when it comes in and if it has a certain match to provide a different hard coded tripcode in place . This may be feasible depending on access to the code base and how it is architected.
I'm with you - I have wondered all along how someone was supposed to rig the salting to generate the same hash for a different password.
As for the whitelisting - the only way I could think of doing it is to fix the salt for a specific account and hardwire it into the hashing code itself. Not impossible, but certainly not a simple task either.
Personally I'm waiting for a trip coded drop with a zero delta before I'm 100% convinced.
Agreed the whole "whitelisting" tripcodes sounds fishy, and I wonder why there is no explanation of what or how that was done. However, if I was developing something like that then I would:
My brain hurts and I want hash browns now…
But here to say thank God we have people like you guys on our side too!
#MAGA
Nice and salty hash browns
This is how I see it as well.
Edit: also entirely possible to check a tripcode when it comes in and if it has a certain match to provide a different hard coded tripcode in place . This may be feasible depending on access to the code base and how it is architected.
I'm with you - I have wondered all along how someone was supposed to rig the salting to generate the same hash for a different password.
As for the whitelisting - the only way I could think of doing it is to fix the salt for a specific account and hardwire it into the hashing code itself. Not impossible, but certainly not a simple task either.
Personally I'm waiting for a trip coded drop with a zero delta before I'm 100% convinced.
This is pretty much exactly what I said. It must be the same 4 accounts downvoting lol.