3 ms·
My first thought is that if you have the old password then it was not stored properly in the first place. Need to fix that first. Second thought is that anythi
by rgacote 10y ago
My first thought is that if you have the old password then it was not stored properly in the first place. Need to fix that first.
Second thought is that anything that exposes information about the existing password is an information leak just waiting to be exploited.
- safetyconcerns 10y agoYeah it is a hash of the password, not the password. So you would check the hash in the signed link and compare to the stored one. But I agree, I don't like the feeling of it.