diff options
| author | Rubin Xu <rubinxu@google.com> | 2018-03-30 20:59:28 +0100 |
|---|---|---|
| committer | Rubin Xu <rubinxu@google.com> | 2018-04-21 09:46:23 +0100 |
| commit | f01e90789eb27bc538df13374b6e67991c0ea829 (patch) | |
| tree | dd80cb4b98b2dbfa23c9f3ac021685728d753620 /tools/aapt2/java/JavaClassGenerator_test.cpp | |
| parent | d7cea28bbc43e80dd7da44b275ffe53f127af0bf (diff) | |
Make password history hashing more secure
Instead of hashing the password directly which makes it possible to bruteforce
the password offline, hash the password together with the synthetic password.
This means without knowledge of the synthetic password, the hash itself is
useless.
As a consequence of this change, saving and checking historical password would
now also require the current device password to be provided. Checking password
history also takes more time due to the need to unwrap synthetic password, at
around 100-200ms.
Bug: 32826058
Test: manual
Change-Id: Icb65171b8c8b703d8f0aa3a8cb2bf7ad96c1332d
Diffstat (limited to 'tools/aapt2/java/JavaClassGenerator_test.cpp')
0 files changed, 0 insertions, 0 deletions