3 ms·
If an attacker has plain text access to the database, they likely don’t care about resetting a password to gain access to a user’s account.
by Zanfa 3y ago
If an attacker has plain text access to the database, they likely don’t care about resetting a password to gain access to a user’s account.
- lcnPylGDnU4H9OF 3y agoIt's more an assumption I make to help guide how I build applications. Put another way, I wouldn't bother hashing the user password if I expected that I would always perfectly prevent all unauthorized reads from the database. If someone knows that my application will just use the last 10 characters of the salt for a password reset token and they initiate the password reset for a user, they can potentially use the data from last month's breach to reset a user's password.
- samrolken 3y agoThe token is further hashed with the application secret key the same way any token would be.