3 ms·

As bad as it is, I can understand accidentally leaving a database accessible (they generally need to be accessible and setting just the right amount of accessib

by jmull 8y ago

As bad as it is, I can understand accidentally leaving a database accessible (they generally need to be accessible and setting just the right amount of accessible can be complex). But this: > ...plaintext passwords... Why, oh why, store plaintext passwords?!?

napolux 8y ago
* Because you are outsourcing development and you don't control * Because it's your first app (or something like that)
glvn 8y ago
I can sort of see why and it's for the same reason databases are left wide open. You start a project. You set up a DB with minimal security because you're just starting the project, and you figure that down the road before you release to the public, you will secure that DB. A few weeks/months pass and you are ready to release your app into the wild. But by that time you are focused on other things and that unsecured DB is forgotten because it has "just worked" since that initial setup. You release and sometime later something like this happens because that DB never got the attention to security it needed because it "just worked" and was forgotten. Don't get me wrong this is still very bad. But I can see how an unsecured server/plaintext passwords happen. It's not by design b but rather a shortcut you took way back when that you have since completely forgotten about.
- brlewis 8y ago
  There are better shortcuts today. Use passport-twitter or some other package to authenticate using a third party. Works for local development too as long as you're connected to the Internet when you want to log in.
- jmull 8y ago
  The password still has to get into the database... something passes it to an insert query or request. It just needs to hash the password on its way through. Let’s see: * identify a hashing library * install/import it * call it (when storing the password and when comparing) It’s a matter of minutes really.

by jmull 8y ago

napolux 8y ago

* Because you are outsourcing development and you don't control * Because it's your first app (or something like that)

glvn 8y ago

I can sort of see why and it's for the same reason databases are left wide open. You start a project. You set up a DB with minimal security because you're just starting the project, and you figure that down the road before you release to the public, you will secure that DB. A few weeks/months pass and you are ready to release your app into the wild. But by that time you are focused on other things and that unsecured DB is forgotten because it has "just worked" since that initial setup. You release and sometime later something like this happens because that DB never got the attention to security it needed because it "just worked" and was forgotten. Don't get me wrong this is still very bad. But I can see how an unsecured server/plaintext passwords happen. It's not by design b but rather a shortcut you took way back when that you have since completely forgotten about.

brlewis 8y ago
There are better shortcuts today. Use passport-twitter or some other package to authenticate using a third party. Works for local development too as long as you're connected to the Internet when you want to log in.
jmull 8y ago
The password still has to get into the database... something passes it to an insert query or request. It just needs to hash the password on its way through. Let’s see: * identify a hashing library * install/import it * call it (when storing the password and when comparing) It’s a matter of minutes really.