3 ms·
Well, it doesn't sound bad, until you rephrase it to how it will actually be implemented: How about allowing the contents of the hash column in the database as
by swolchok 17y ago
Well, it doesn't sound bad, until you rephrase it to how it will actually be implemented:
How about allowing the contents of the hash column in the database as the password?
It only takes one incompetent engineer to sometimes store the raw password in the database, and it takes two to make that work to log in somewhere (presumably an easy defense is to only allow "verbatim logins" using something the same length as a hash).
- brown9-2 17y agoAlso it would defeat the purpose of having passwords hashed, because a data leak would then expose people's account just as if you were storing the plaintext password.
- mbrubeck 17y agoAt the one place I worked where this was actually implemented (spoof a user by entering a hashed password), it only worked from inside the firewall, to mitigate this risk. According to the interview, Facebook has similar restrictions on user spoofing.