this post was submitted on 24 Jan 2024
391 points (98.5% liked)

Cybersecurity - Memes

2000 readers
1 users here now

Only the hottest memes in Cybersecurity

founded 1 year ago
MODERATORS
Sam1232188
neurohost
[email protected]
[email protected]
CannaVet
391
Your password must also not contain the following character combinations: script, select, insert, update, delete, drop, --, ', /*, */. (lemmy.world)
submitted 10 months ago by ABasilPlant to c/cybersecuritymemes
59 comments fedilink hide all child comments
 
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 10 points 10 months ago (2 children)

No one in their right mind is storing plain text passwords, or letting them anywhere near the database.

You convert the password to a hash, and store that. And the hash will look nothing like the password the user typed.

[–] acetanilide 12 points 10 months ago (1 children)

You're right. No one in their right mind would do that.

On the other hand, people not in their right mind often run things. Such as my old professional liability insurance. Which wrote the username and password in the yearly statements...

And also sent you the password through email if you forgot it...

Also you couldn't change it...

[–] BURN 7 points 10 months ago (1 children)

There was a popular companion app to a game I play that’s stored passwords as MD5 hashes for years and when they got hacked they were able to decrypt everything.

Bonus point, the app was released multiple years after md5 was cracked.

Developers (including myself) cannot be trusted to implement the correct process 100% of the time. It’s happened too many times for it to be a single person issue and has transcended into a problem with software engineers

[–] acetanilide 2 points 10 months ago

😬😬 that's crazy but good to know

[–] usefulthings 3 points 10 months ago

Lol. Yes, people do still build systems and store plain text passwords. I regularly get scammers sending me my throwaway passwords from crappy sites. Good thing I never reuse passwords, or email addresses.