Add a "Password already belongs to user: " when you sign up, similar to when an email is taken.

Do you want rainbow tables? Because that's how you get rainbow tables.

I KNOW THIS IS CRAZY IDEAS BUT THIS IS IMPORTANT:

An okay website will store your password with a one-way encryption protocol. That means that even if someone gets their database, they still don't have your password - they have a random string of letters and numbers that is the encrypted password. The website can still authenticate that it's you by taking the password you put in and putting it through the same crypto function. Doing what you suggest with this kind of system would be easy - encrypt the requested password, see if it's in the database.

But this kind of storage system is susceptible to dictionary attacks (attacker randomly throws together words from the dictionary, often with numbers replacing certain letters e.g. 4 for A) if the crypto function doesn't take very long to run, and rainbow tables. Rainbow tables are a (really large) set of data with precomputed string -> encrypted value associations. The attacker can just take your encrypted password out of the database and look it up in their rainbow table.

That's why there's a thing called salting your passwords. A random value is generated for each new password, is appended to the password before it is encrypted, and then stored alongside that password.

To implement this kind of thing for a secure site like that, you'd need to run your crypto function over each password stored in the database - and many crypto functions, in order to stave off brute force attacks, take a long time (in computer time) to run. It could take longer than 10 minutes - or even an hour! Or ten years! Depends on the number of logins and the complexity of the crypto function.

Also, if you got this message, and you could get a list of email addresses registered in the system, you could just try that password on each email address and voila.

/r/CrazyIdeas Thread