4 ms·

This came up in the stackoverflow podcast where Reddit founders were the guest. They mentioned that they stored plain text passwords initially which is fundamen

This came up in the stackoverflow podcast where Reddit founders were the guest. They mentioned that they stored plain text passwords initially which is fundamentally a bad design but at the same time it helps to block spam. If a user starts to create a lot of accounts programmatically they generally use the same password thus much easier to filter. Security via Obscurity, if you can do it, can be very very effective.

tgb 6y ago
You could do that without a plain-text password, though with a salt it would be harder (though you could still do it proactively by checking the password when the account is made).
- abhishekjha 6y ago
  Yes, there was an ongoing criticism from Joel regarding storing plain text passwords.
- tzs 6y ago
  To check the new account's password at creation time against existing salted hashes, you'd have to hash the new password with each existing password's salt. If you are using something like bcrypt or scrypt which is designed to be slow at this, that might take a while if you have a lot of existing accounts. Maybe a Bloom filter approach? Besides the salted slow hash you store of each password, also put the password in a Bloom filter. Check new passwords against the Bloom filter. You'll get some false positives that way, but maybe that is acceptable. I'm seriously tempted, if I ever have to implement a password system again, to allow up to 256 characters, just store an unsalted SHA256 hash, and tell people on signup that they should be using a password manager with a long random password if they care about security of their account.
salamander014 6y ago
It's possible to track similar passwords in a safe way over a short amount of time. Keeping any user's password or any security token in plaintext is just disgusting. Regular people have a hard enough time navigating the digital world without needing to worry about whether their credentials are safe. Anyone who stores passwords in plaintext is disgusting and should not be managing digital services. Period. This is how breaches happen, and it should be a fine-able offense.

tgb 6y ago

You could do that without a plain-text password, though with a salt it would be harder (though you could still do it proactively by checking the password when the account is made).

abhishekjha 6y ago
Yes, there was an ongoing criticism from Joel regarding storing plain text passwords.
tzs 6y ago
To check the new account's password at creation time against existing salted hashes, you'd have to hash the new password with each existing password's salt. If you are using something like bcrypt or scrypt which is designed to be slow at this, that might take a while if you have a lot of existing accounts. Maybe a Bloom filter approach? Besides the salted slow hash you store of each password, also put the password in a Bloom filter. Check new passwords against the Bloom filter. You'll get some false positives that way, but maybe that is acceptable. I'm seriously tempted, if I ever have to implement a password system again, to allow up to 256 characters, just store an unsalted SHA256 hash, and tell people on signup that they should be using a password manager with a long random password if they care about security of their account.

salamander014 6y ago

It's possible to track similar passwords in a safe way over a short amount of time. Keeping any user's password or any security token in plaintext is just disgusting. Regular people have a hard enough time navigating the digital world without needing to worry about whether their credentials are safe. Anyone who stores passwords in plaintext is disgusting and should not be managing digital services. Period. This is how breaches happen, and it should be a fine-able offense.