3 ms·
An extremely large company I was involved in building a system for had a requirement that you be able to read your password over the phone to a call center agen
by menssen 10y ago
An extremely large company I was involved in building a system for had a requirement that you be able to read your password over the phone to a call center agent, resulting in requirements like case insensitivity and character limits.
Terrible security, sure, but at least it came from the desire for usability, not just basic encryption idiocy.
- mjevans 10y agoNo, the system isn't secure. The text of the password should not persist.
- f0urtyfive 10y agoWho said the text persists, you could take it off the phone and type it in to compare against any existing salted hash. Still not good security, but not necessarily stored in plaintext.
- menssen 10y ago(For the record, yes this is how it worked.)