3 ms·
That's a neat hack if you only have one input box. But all the extra code on the backend needed to differentiate between a normal password and a password+pin so
by qwertox 5y ago
That's a neat hack if you only have one input box. But all the extra code on the backend needed to differentiate between a normal password and a password+pin sounds like something which could accidentally weaken security.
- mc32 5y agoMaybe they’re leveraging radius for some of of that?
- Fnoord 5y agoOr PAM, or BSD_Auth, or AD, or ... there's a lot of options. Supposedly they can also see which capabilities the client has, allowing the fix server side. Why they did that we can only speculate, same with why its not well known. I can imagine an engineer with a kid who got a handmedown from mom/pop, and they silently fixing it this way because its within their expertise. I'd like to hear the authentic story behind it. Hopefully one day!
- dzhiurgis 5y agoIt's really not that complicated given it's a fixed 6 digit appendage
- garmaine 5y agoA secure app shouldn’t be sending passwords in the clear though.