3 ms·
> fixing the password security would've required breaking everyone's ability to commit to the PHP codebase The parameterized queries could have been fixed, tho
by striking 6y ago
> fixing the password security would've required breaking everyone's ability to commit to the PHP codebase
The parameterized queries could have been fixed, though, right? And you can progressively update people's passwords to a different algorithm as they log back in, and warn them that in six months their password will need to be reset if they haven't logged in.
- blowski 6y agoAnd if someone hasn’t logged in for 6 months, their account should probably deactivated anyway. But, yeah, the comment above is right about enterprise IT. I’ve sat in on meetings where 2FA was ruled out as being too unusable by the marketing team, who said quarterly password rotations were a “good compromise”. They just want to be seen to be doing something about security, and pick fixes that don’t involve much cost to anybody, but also tend to provide little value.