4 ms·

It has nothing to do with programming. It's a design choice that has only a few downfalls which basically coincide with huge security problems. If a user has t

by aston 19y ago

It has nothing to do with programming. It's a design choice that has only a few downfalls which basically coincide with huge security problems. If a user has the ability to run a query on your DB, I doubt the dangerous one is to log in as a user... Same goes with swiping your laptop.

run4yourlives 19y ago
>It's a design choice that has only a few downfalls One of those downfalls is exposing your user to a host of vulnerabilities should one of those other "security problems" happen. Why would you figure that the user is only using your DB? Websites are plentiful, and the "typical" user has one password for many sites. If they don't, they're hardly attached to the current one - they forgot it after all! It's understanding that your app doesn't exist in a bubble and looking out for the best interests of your users that leads to storing passwords in a hash. When you have "design decisions" that put marginal convenience over security, I honestly question the integrity of you as the owner operator. Why exactly do you need to see my password anyway?
- aston 19y ago
  I think retrieving a password is more than a marginal convenience for some audiences. And again, off all the things in a database you don't want the world to see or manipulate, a user's password is pretty low down on the list. No matter what, as the operator of a website, you'll need to make your own decisions about the various tradeoffs involved. edit: If, as you asserted, a user forgetting a password means that they're not attached to it, that's all the more reason to keep it around, since they aren't using it elsewhere. I don't think it's unreasonable to assume that people won't break in and see the database (short of you screwing something more important up).
  - run4yourlives 19y ago
    >off all the things in a database you don't want the world to see or manipulate, a user's password is pretty low down on the list. Clearly, we disagree philosophically on this point. I just hope my bank never starts thinking like that.
    - aston 19y ago
      If I were your bank, I wouldn't even be relying on passwords alone. Like I said, per application decision-making is the only 'right' approach here.

by aston 19y ago

run4yourlives 19y ago

>It's a design choice that has only a few downfalls One of those downfalls is exposing your user to a host of vulnerabilities should one of those other "security problems" happen. Why would you figure that the user is only using your DB? Websites are plentiful, and the "typical" user has one password for many sites. If they don't, they're hardly attached to the current one - they forgot it after all! It's understanding that your app doesn't exist in a bubble and looking out for the best interests of your users that leads to storing passwords in a hash. When you have "design decisions" that put marginal convenience over security, I honestly question the integrity of you as the owner operator. Why exactly do you need to see my password anyway?

aston 19y ago
I think retrieving a password is more than a marginal convenience for some audiences. And again, off all the things in a database you don't want the world to see or manipulate, a user's password is pretty low down on the list. No matter what, as the operator of a website, you'll need to make your own decisions about the various tradeoffs involved. edit: If, as you asserted, a user forgetting a password means that they're not attached to it, that's all the more reason to keep it around, since they aren't using it elsewhere. I don't think it's unreasonable to assume that people won't break in and see the database (short of you screwing something more important up).
- run4yourlives 19y ago
  >off all the things in a database you don't want the world to see or manipulate, a user's password is pretty low down on the list. Clearly, we disagree philosophically on this point. I just hope my bank never starts thinking like that.
  - aston 19y ago
    If I were your bank, I wouldn't even be relying on passwords alone. Like I said, per application decision-making is the only 'right' approach here.