4 ms·
It probably should, since it would mean that the site isn't hashing passwords with even the most ancient cipher. Bonus ineptness points are given for not using
by curun1r 9y ago
It probably should, since it would mean that the site isn't hashing passwords with even the most ancient cipher. Bonus ineptness points are given for not using a prepared statement or sanitizing the SQL query.
As a software developer, I'm okay with that being criminal negligence.
- Casseres 9y agoI think the previous person meant it being possibly a crime for the user, not the developer.
- curun1r 9y agoHence the attempt at humor through deliberate misinterpretation of an ambiguously-worded statement where the intent was clear.
- acchow 9y agoCute. I am still curious if this would be a criminal offense for the person that did the SQL injection attack.
- ransom1538 9y agoIn the US, the "Computer Fraud and Abuse Act" could apply. The case would revolve around "intent". Explaining to interrogating officers that you hated password forms and wanted revenge would be 1 to 5 years in federal prison (better than state). Explaining to interrogating officers that you accidentally copy pasted wrong - the case would be dropped. This is why you need see a lawyer always before answering questions you will be mislead. "intentionally accesses a computer without authorization or exceeds authorized access" [1] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://www.nacdl.org/cfaa/ https://www.nacdl.org/cfaa/