Only store leading 13 bits of password hash.

chrome/browser/signin/local_auth.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // The local-auth module allows for user authentication in the case when
 // on-line authentication is not possible (e.g. there is no network
 // connection).
 
 #ifndef CHROME_BROWSER_SIGNIN_LOCAL_AUTH_H_
 #define CHROME_BROWSER_SIGNIN_LOCAL_AUTH_H_
@@ skipping 15 matching lines @@
 
 void SetLocalAuthCredentials(const Profile* profile,
                              const std::string& password);
 
 bool ValidateLocalAuthCredentials(size_t profile_info_index,
                                   const std::string& password);
 
 bool ValidateLocalAuthCredentials(const Profile* profile,
                                   const std::string& password);
 
+// Return only the first |len_bits| bits of the string |str|.
+std::string TruncateStringByBits(const std::string& str, const size_t len_bits);

[bcwhite, 2015/01/21 21:04:40]

Why does this need to be public?

[Mike Lerman, 2015/01/27 21:02:26]

So I can unit test it. 

[jww, 2015/01/29 11:44:45]

For unit tests, I've generally made methods private and then used the
FRIEND_TEST_* macros to make the tests friends of the class I want to test. See
https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/ssl...
for an example of this use.

My rule of thumb is that if it's not a public API outside of unit tests, it
should be private/protected.  

[Mike Lerman, 2015/01/29 16:57:42]

I would - if this was a class. Sadly, it's a namespace. Unless I make it a class
with static methods... I can do that.

[jww, 2015/01/29 17:40:57]

Lulz, totally missed that. Nevermind :-)

+
 }  // namespace chrome
 
 #endif  // CHROME_BROWSER_SIGNIN_LOCAL_AUTH_H_