3 ms·
>> Add new tables to hold user's credentials, email addresses, and whatever else. Adding a table to hold users' credentials doesn't really solve the problem th
by IncRnd 7y ago
>> Add new tables to hold user's credentials, email addresses, and whatever else.
Adding a table to hold users' credentials doesn't really solve the problem that is being discussed, which is storing users' credentials. All that does is add a new attack surface, stealing the new credentials, and the original credentials are still in the same position.
- carterehsmith 7y ago>> Adding a table to hold users' credentials doesn't really solve the problem that is being discussed, which is storing users' credentials. ? Not sure if serious.
- aembleton 7y agoYou can salt and hash the new password; and the old password can be in plain text. The old password being in plain text doesn't matter so much if it is not possible to access the legacy system directly from outside of the banks network.
- imtringued 7y agoYes, you are right but we are talking about potential causes of these strange policy decisions. One source is simply old software that cannot be updated but this sub-thread is trying to debunk that by saying that you can have a modern table with hashed passwords and a generated secret value that conforms legacy restrictions. The secret value can be used as a password on the old mainframe. There will be collisions but they can be prevented by comparing usernames. There is no technical excuse for not hashing passwords.