3 ms·
Why don't you simply port the user accounts to your system (including passwords, stored hashed this time) and be done with it? "Plaintext passwords bad", of cou
by JoachimSchipper 15y ago
Why don't you simply port the user accounts to your system (including passwords, stored hashed this time) and be done with it? "Plaintext passwords bad", of course, but I don't even see what you hope to gain - don't you already have a password recovery system for your current subscribers? (And a one-click-from-email login may be nice, but again - why not for current subscribers?)
- chrisacky 15y agoYeah, don't think that I would maintain the plain text passwords. After I create the hashed version, I would drop the plain text and rm -rf the old site. (Well not quite but it will be on it's on from there on). My concern isn't so much about what to do in the future, because from here on out, we will only be using the hashed passwords... I guess the original question could of been summarized to: "Do you think that non-technical people realise that when they receive their passwords in an email that this is bad". Because I would like to make the transition for the users as easy as possible. They will now be accessing and editing their details from the new site.
- japhyr 15y agoYou can just tell the users that their old accounts should work perfectly well on the new system. You can't sort out "non-technical" people from technical people in your userbase. Bad practice is bad practice, and anything to do with plain text passwords is bad practice.