1–10 of 20 posts
Isn't it compulsory to hash user passwords, as otherwise it would be a severe user data compromise? What should be done in this case?
My 2 cents.
Contact the site and give them a time-frame by when they should comply. Politely ask them to comply telling them otherwise you would disclose the site's identity. Also, try and contact security research organizations to notify them of the vulnerability. This would add a little extra pressure on the site's owner to fix the security hole. My 2 cents.
Some sites do it deliberately. If your customer base is mainly non-technical, directly emailing them the password increases the chance they will log in back than sending them a password reset link. I think I read it in context of PlentyOfFish.
> Isn't it compulsory to hash user passwords, as otherwise it would be a severe user data compromise?
If an employee or a cracker has access to the user database, doesn't he already have the user data? The main reason passwords should be hashed is if a rogue employee or a cracker has access to user data(what user data you have is already compromised here), he might be able to gain access to the user's mail, bank or other accounts as most people tend to reuse password.
A more interesting question in this case: how did you find out? Are they leaking the un-hashed password somewhere or did you break in?
> I see a popular website not hashing passwords. Some sites do it deliberately. If your customer base is mainly non-technical, directly emailing them the password increases the chance they will log in back than sending them a password reset link. I think I read it in context of PlentyOfFish. > Isn't it compulsory to hash user passwords, as otherwise it would be a severe user data compromise? If an employee or a crack…
your comment doesn't really add anything, really ...
this guy is right, that's it.
Contact the site and give them a time-frame by when they should comply. Politely ask them to comply telling them otherwise you would disclose the site's identity. Also, try and contact security research organizations to notify them of the vulnerability. This would add a little extra pressure on the site's owner to fix the security hole. My 2 cents.
I don't think an ultimatum would help facilitate the issue being addressed more quickly; I do agree with the latter approach though.
Not an ultimatum. Just do it.
Notify it to all important media in tech world. They will take care of that.
You're absolutely right, it's a major security risk, and anyone else who discovers it may not be so discreet, and make the company a major target for anyone interested interested in stealing databases with unencrypted databases.
We had the same thing happen 2 weeks ago, worse thing is that the company in our case does things with money. Yep.