2 ms·
I'd say it's wrong to assume it's even a security measure. I'm fairly sure it goes like this if (db->query("SELECT * FROM `users` WHERE `email` = 'yesthisisdog
by sgjohnson 4y ago
I'd say it's wrong to assume it's even a security measure. I'm fairly sure it goes like this
if (db->query("SELECT * FROM `users` WHERE `email` = 'yesthisisdog@gmail.com' AND `password` = MD5('hunter2')") {
login(username);
} else {
error('invalid username or password');
}
with nobody giving it a second thought.
- MHard 4y agoWhich in itself would be a bad security practice because that would mean that the passwords aren't individually salted.
- sgjohnson 4y agoAnd they would be hashed using MD5! But on a serious note, it's possible to individually salt passwords, and still match username & password in one query.
- capableweb 4y agoAs someone who written countless of this authentication mechanisms or led teams that have, there has been 0 times the vague message have been by accident like you described and 100% on purpose to prevent information leakage. But that's just one (20+) anecdote(s).
- datalopers 4y ago> MD5(‘****’) That’s cool HN censors passwords like this
- Sohcahtoa82 4y agoEverything about that query makes me cry.
- sgjohnson 4y agoThanks, I tried