Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was just wondering if, due perhaps to different hashing methods, knowing that the password is the same for a Windows 7 and an Ubuntu system would make either system more vulnerable. The OSs are dual booted from the same laptop using GRUB.

share|improve this question

migrated from Oct 28 '13 at 21:47

This question came from our site for professional and enthusiast programmers.

up vote 0 down vote accepted

If you are asking about the scenario that someone knows that a password is the same on two systems using different hash methods and is trying to compare the hash outputs to get the password - that really can't work. Hashes are one-way functions designed so that you can't get the password from the hash. You can't compare the two hashes against each other either. This assumes that the hashing algorithms are good and the hash lengths are long enough for security and that the person is using some sort of decent password.

To explain that, if the hash isn't good and the output long enough, a rainbow attack is possible. Even if you have a very good hash and very long outputs - say 256bit or so - the typical "dumb" passwords like "12345" and "password" and others would be the first hashes to be created and tested against. After that, it is brute force.

share|improve this answer
You are basically saying "No" without really answering "Why". I'm not claiming that "No" isn't correct (I don't know for certain), I'm just saying you're handwaving away the "Why". Couldn't values from one hash be used to help assist the crack of the other? We find weaknesses in hashes frequently, why is having a different hash something that "really can't work"? – McKay Aug 17 '15 at 13:48
A hash is a one way mathematical problem. Put in a password, run it through the hash and what comes out is your hashed password. There should be no way to run it backwards - even if you know the hash algorithm and know the output. So getting the password from the hash isn't feasible. The only way to break it is to run all possible passwords and get all outputs and then match what you have against all the outputs (rainbow table). Then you have Linux which uses a different hash than Windows and salts the hash with a random variable - the result is totally different. – Blackbeagle Aug 18 '15 at 6:38
The only thing feasible from the scenario would be to break the weaker windows hash method by brute force or rainbow tables or other method and then you'd have the password and the stronger linux method wouldn't matter. – Blackbeagle Aug 18 '15 at 7:01
"There should be no way to run it backwards". Yes. I totally agree. but "should" is not the same as "is". Hashes do get broken. Having a separate hash could be used to assist. This "shouldn't" be the case. But is it? – McKay Aug 18 '15 at 13:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.