51–60 of 160 posts
Why are people still relying on developers to implement proper password security instead of using unique passwords?
Earlier quoted context omitted.
It has to be plaintext in the db, because they can't reverse the hash back to plaintext to send to you.
Not quite true. It could be (and probably is) encrypted in the database.
Earlier quoted context omitted.
It has to be plaintext in the db, because they can't reverse the hash back to plaintext to send to you.
Not quite true. It could be (and probably is) encrypted in the database.
Earlier quoted context omitted.
Simple, for every user that the hackers have, try their password for the associated email account, guaranteed they will gain access to many email accounts. Now they have access to their banking accounts.
This could happen, but do we have any evidence that it has? I'm being serious...I constantly hear about widespread leaks of passwords, but the most I hear about it is people having their email hacked by a botnet to...send spam. Have their been any large scale attacks to gain access to bank accounts to then clean them out somehow? On top of that, how does getting access to someone's bank account even help you? You hav…
Earlier quoted context omitted.
Not quite true. It could be (and probably is) encrypted in the database.
Can you elaborate? I don't know any way to take a hashed password and get the plaintext version. When you log into any app i've worked on, we hash the pw you send and match it with the one in the db. This is why you have to get a password reset most of the time, because the company literally does not know your password.
However, encryption is the the same as hashing, and it can be decrypted. It is possible that they are not hashing your password, but encrypting it, before they put it into the database.
Earlier quoted context omitted.
Not quite true. It could be (and probably is) encrypted in the database.
Can you elaborate? I don't know any way to take a hashed password and get the plaintext version. When you log into any app i've worked on, we hash the pw you send and match it with the one in the db. This is why you have to get a password reset most of the time, because the company literally does not know your password.
Earlier quoted context omitted.
Not quite true. It could be (and probably is) encrypted in the database.
Can you elaborate? I don't know any way to take a hashed password and get the plaintext version. When you log into any app i've worked on, we hash the pw you send and match it with the one in the db. This is why you have to get a password reset most of the time, because the company literally does not know your password.
My jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking? It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is storing users' passwords in plaintext. It is possible that Pandora remembers your password server-side for y…
It has to be plaintext in the db, because they can't reverse the hash back to plaintext to send to you.
My jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking? It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is storing users' passwords in plaintext. It is possible that Pandora remembers your password server-side for y…
Even if they are just using saving it in session they aren't using https