Google如何使用以前密码的最佳猜测？
众所周知，密码哈希用于确保密码的完整性，换句话说，密码被解密，几乎无法逆转（除非您具有无限的计算能力）。以下几行仅从Google支持页面复制：
If you can't confidently recall any previous passwords: Take your best
guess.
即使无法比较两个密码的哈希。 那么，要求某人猜测的意义何在！ Google如何使用最佳猜测来确保此帐户属于某人？他们是否使用超级计算机来打破哈希并将其与最好的猜测进行比较？
As we all know Password hashing is used to ensure the integrity of passwords , in other words the password is decrypted and almost can't be reversed ( unless you have unlimited computing power). the following lines are just copied from google support page :
If you can't confidently recall any previous passwords: Take your best
guess.
Hashes of two passwords even if they are so close can't be compared .
So what's the point of asking someone for a guess !
How google uses the best guess to make sure that this account belongs to someone ? Do they use their super computers to break the hashes and the compare it with the best guess ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这很可能与A 特定密码的变体有关，而是关于不同的密码。
这只是猜测，但是Google可能会存储少量的密码历史记录，并将您对先前密码的知识视为您是帐户持有人的薄弱信号，并相应地调整工作流程的其余部分。
（嗯，不是完全 猜测 - 我已经完成了几次工作流，而且确实知道我以前的一些密码。它们只是碰巧彼此完全不同，而不是变化。）
It's likely that this is less about variants of a specific password, but instead about different passwords.
This is just speculation, but Google probably stores a small amount of password history, and takes your knowledge of a previous password as a weak signal that you are the account holder, and adjusts the rest of the workflow accordingly.
(Well, not entirely speculation - I've done this workflow a few times, and it did know some of my previous passwords. They just all happened to be entirely different from each other, not variations.)
我有一个猜测/想法，即如何实现...
输入不正确的密码时，最初将将哈希人与存储的值进行比较，并使测试失败。正如问题所指出的那样，哈希的变化无助于查看故障是否是由于未记录的但“类似”的密码。
在失败时，当提供“最佳猜测”时，突变不正确的纯文本字符串并哈希进行比较将是相对廉价的。原则上，突变甚至可以在客户端机器上进行。
Google有无数数万亿个与人为错误的特质有关的数据点，包括使我们有正确的单词，多年来数十亿次互联网搜索和其他互联网活动的记忆技巧。提交的纯文本的错误突变可能是非随机的，而是在人类怪癖的先验知识的指导下进行指导。例子可能是用3代替E但有时还会恢复为E的人。我想，当密码失败，但具有较大的试用组合时，我们自己尝试的事情类型。
我建议在哈希之前突变纯文本的关键。
I have a guess/idea of how that might be achieved...
On entering an incorrect password, initially the hash will be compared to the stored value and fail the test. As the question points out, variations of the hash would not be helpful in seeing if the failure was due to a miss-remembered but 'similar' password.
On failure, when the 'best guess' is offered, it would be relatively computationally inexpensive to mutate the incorrect plain text string and hash the results for comparison. In principle, the mutation could even be done on the client machine.
Google has countless trillions of data points relating to the idiosyncracies of human error, including memory tricks that convince us we have the right word, gleaned over years of countless billions of internet searches and other internet activities. It is possible that mutation of errors of the submitted plain text is non-random and instead guided by that prior knowledge of human quirks. Examples might be people who replace e with 3 but sometimes revert to e. I suppose the types of things we ourselves try when a password fails but with a larger set of trial combinations.
The key to my suggestion being mutating the plain text before hashing.