4 ms·

Only the hashed versions should ever be stored. Like the OP said there is Zero reason to store plaintext user passwords.

by pm90 5y ago

actually_a_dog 5y ago
IMO, it's likely that the article was confusing "passwords" with "hashes" here. No company the size of Facebook is going to be storing plain-text passwords in 2021.
- dylan604 5y ago
  "No company the size of Facebook is going to be storing plain-text passwords in 2021 on purpose." We've seen stories where the servers were logging the plain text data it received where those logs persisted for some time, but the plain text was never "stored" in the database.
version_five 5y ago
Related anecdote, when I was in university, I had changed my university IT services password to something "offensive" (had the F word in it) after getting frustrated trying to find one that met the novelty and entropy requirements. I was contacted later by IT to tell me that was an inappropriate password and to change it. I found it much more offensive to know that IT could see my password in plain text, than I would to read a swear word.
- guenthert 5y ago
  The password probably was not stored in plaintext (if you've been to University in the last thirty years), but IT staff might have periodically ran a password-cracking tool in order to find weak passwords (and swear words in various languages will certainly be in their dictionary). They alert the user and request the password to be changed (might disable the weak one) in order to safeguard their network.
  - version_five 5y ago
    This is an interesting point, and I did consider it as I was typing the comment. If I remember correctly, the password was fuckStateU+1 with my university name (abbreviation) subbed in (like I said, I was getting angry trying to meet the special character etc requirements). Do you think password cracking software they use would break suck a password any faster than brute force? I suppose its possible but I'd discounted it. This was about 15-16 years ago I think.
PeterisP 5y ago
There are all kinds of places storing things that aren't explicitly stored. For example, a VM snapshot of a system that was processing a request including a password and had it in the memory at the time, any service (including something that does just network proxying) with a debug mode that logs full request data, etc.

Only the hashed versions should ever be stored. Like the OP said there is Zero reason to store plaintext user passwords.

by pm90 5y ago

Only the hashed versions should ever be stored. Like the OP said there is Zero reason to store plaintext user passwords.

actually_a_dog 5y ago

IMO, it's likely that the article was confusing "passwords" with "hashes" here. No company the size of Facebook is going to be storing plain-text passwords in 2021.

dylan604 5y ago
"No company the size of Facebook is going to be storing plain-text passwords in 2021 on purpose." We've seen stories where the servers were logging the plain text data it received where those logs persisted for some time, but the plain text was never "stored" in the database.

version_five 5y ago

Related anecdote, when I was in university, I had changed my university IT services password to something "offensive" (had the F word in it) after getting frustrated trying to find one that met the novelty and entropy requirements. I was contacted later by IT to tell me that was an inappropriate password and to change it. I found it much more offensive to know that IT could see my password in plain text, than I would to read a swear word.

guenthert 5y ago
The password probably was not stored in plaintext (if you've been to University in the last thirty years), but IT staff might have periodically ran a password-cracking tool in order to find weak passwords (and swear words in various languages will certainly be in their dictionary). They alert the user and request the password to be changed (might disable the weak one) in order to safeguard their network.
- version_five 5y ago
  This is an interesting point, and I did consider it as I was typing the comment. If I remember correctly, the password was fuckStateU+1 with my university name (abbreviation) subbed in (like I said, I was getting angry trying to meet the special character etc requirements). Do you think password cracking software they use would break suck a password any faster than brute force? I suppose its possible but I'd discounted it. This was about 15-16 years ago I think.

PeterisP 5y ago

There are all kinds of places storing things that aren't explicitly stored. For example, a VM snapshot of a system that was processing a request including a password and had it in the memory at the time, any service (including something that does just network proxying) with a debug mode that logs full request data, etc.