Cybersecurity - Memes

2000 readers

1 users here now

Only the hottest memes in Cybersecurity

founded 1 year ago

MODERATORS

391

Your password must also not contain the following character combinations: script, select, insert, update, delete, drop, --, ', /*, */. (lemmy.world)

submitted 10 months ago by ABasilPlant to c/cybersecuritymemes

59 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 52 points 10 months ago (3 children)

So they’re not hashing or salting the passwords too. Cool…

[–] [email protected] 17 points 10 months ago (1 children)

They might be doing it in the DB query, but they’re definitely not sanitized beforehand.

[–] CrayonRosary 2 points 10 months ago (1 children)

Sanitization has nothing to do with salting and hashing.

[–] [email protected] 2 points 10 months ago

If you do the salting and hashing in a database query you need to sanitize the input before you use it or you open yourself to SQL injection.

Databases have salting and hashing functions, after all

[–] Rednax 9 points 10 months ago (1 children)

Which makes me want to try and insert a password of a few megabytes worth of text. Should be fine, since there is no max lenght defined, right?

[–] [email protected] 4 points 10 months ago

If there is no overwrought prohibition of something I know that at least in America that means it’s

Affirmatively legal and
Legislatively encouraged by the FREEE Act

So give ’em hell!

[–] CrayonRosary 1 points 10 months ago* (last edited 10 months ago)

That's not how it works. The code always has access to the submitted plaintext password. It's salted and hashed after it's verified for complexity. The complexity verification can even be done in JavaScript.