3 ms·
"Do you want 0%* of sites to claim that passwords are secure, even if they use a well-configured bcrypt and follow best practices?" Yes, because passwords are
by betterunix 13y ago
"Do you want 0%* of sites to claim that passwords are secure, even if they use a well-configured bcrypt and follow best practices?"
Yes, because passwords are insecure even if you follow "best practices." Here is a straightforward attack:
http://www.businessinsider.com/how-mark-zuckerberg-hacked-into-the-harvard-crimson-2010-3 http://www.businessinsider.com/how-mark-zuckerberg-hacked-in...
- Dylan16807 13y agoUhh, I don't think best practices include logging the passwords people try to login with.
- betterunix 13y agoYou are missing the point. It makes no difference if your website is following best practices if your users enter their passwords on a website that fails to do so. Maybe your users are using the same passwords in many places. Maybe they accidentally entered the password for one website when trying to log in to another because their username is the same.