5 ms·
I believe the correct approach for us is to assume all Lish password where in clear text until a good explanation is given. It's not usual to store some passwor
by iaskwhy 14y ago
I believe the correct approach for us is to assume all Lish password where in clear text until a good explanation is given. It's not usual to store some password in clear text and encrypt the others, right?
- threeseed 14y agoStoring passwords in clear text is definitely not normal. Also the social engineering implications could be huge. Many people use the same password across various sites so in theory there could be a lot of compromised email accounts. Which could then mean compromised internet banking sites, trading sites etc.
- piggity 14y agoCould be that the passwords were hashed, but something logged a password, or there was leakage somewhere during the login process. All it takes is one debug log statement to leak through from development and you can be logging plain-text passwords on every login.