5 ms·
I am also in whole-hearted agreement with Linus, here. In fact, I ran into this just recently. I discovered one of our systems at work actually stored encrypt
by ryangittins 9y ago
I am also in whole-hearted agreement with Linus, here. In fact, I ran into this just recently. I discovered one of our systems at work actually stored encrypted passwords rather than just hashed ones, and decrypted it for validation. Yuck!
Of course, I put a fix and a database migration in place as soon as I could and all is well now, but this worries me. It worries me because it must have been done out of ignorance (bad) or intentionally (worse) and billed as a feature or something. Neither of these things are mere bugs. This gaping flaw wasn't introduced by accident.
- baby 9y agoNote that a hash is not enough, you need a password hash (or some people call that phash, whatever). Argon2 is currently the recommendation to do such things.
- thisisit 9y agoOr maybe incomplete understanding of the system. I had lobby for a year to get even a simple encrypted passwords. "Why do we need encrypted passwords behind a corporate firewall?" they asked. That sucked all the energy out of me. So when they wrote a script to run a db extract, get all company salary data in csv and share it with literally 50+ people I gave up. Getting them to even encrypt data seemed impossible.
- ryangittins 9y agoOh geez, that's nuts. That's like asking, "Why do I need to put my valuables in a safe if I have a lock on my front door?"
- scruple 9y ago> That's like asking, "Why do I need to put my valuables in a safe if I have a lock on my front door?" Not the GP, but I've experienced similar things during my career, and these sorts of analogies tend to work really well when explaining technical points to non-technical (and, sadly, even "technical") people.