5 ms·
Microsoft Outlook (hotmail) doesn't hash passwords?
- legatou 13y agoI must admit, as a software dev I'm quite distressed that this is what I was prompted with when I tried to login to my email today.
- 27182818284 13y agoFrom that warning message there, I don't know how you determined that they aren't hashing. You might have to spoon-feed it to me. I feel like they are just looking out for whatever legacy systems that will stroke if you pass more than 16 char to them?
- legatou 13y agoIn order to validate that my 16-char truncated password is correct, they would have to have my password stored somewhere. Standard security practice is to store ONLY the hash of a password, and never the password text.
- heywire 13y agoWhat if they never stored more than 16 characters, and only recently added the message?
- 27182818284 13y agoI don't get that from the message though. To me it seems like they do a len() on the input box before it would ever be hashed or stored or anything like that on the server.
- nate 13y agoIf you hash a password, when a user logging in enters their password you convert what they type into a hash and compare that hash to the hash you have stored. A partial password (like the first 16 characters) isn't going to equal the same hash that you have stored in your database.
- orlandoseo 13y agoThey probably de-crypted the original password and rehashed the actual first 16 characters updaing the HASHed version of the password compare. It's not uncommon to have the HASH and an encrypted version of the password.
- legatou 13y agoIf they have the decryption keys, that's the same as storing the password in plaintext. I don't know how common it is, but I know it's insecure.