3 ms·
I think the OP should name and shame the site that takes passwords over a non-secure connection, stores them in plain text, and silently truncates long ones. Ma
by MattBearman 13y ago
I think the OP should name and shame the site that takes passwords over a non-secure connection, stores them in plain text, and silently truncates long ones. Maybe that would get them to fix it.
- paulannesley 13y agoThat could do more harm to the site users than the site itself. Especially with people sharing passwords between sites. I guess that's an example Full Disclosure vs (as an alternative) Coordinated Disclosure; http://en.wikipedia.org/wiki/Full_disclosure_(computer_security) http://en.wikipedia.org/wiki/Full_disclosure_(computer_secur...
- Robadob 13y agoMicrosoft used to truncate live/hotmail passwords silently to 16 chars pre-hash, I recall them announcing the change to an upper length of 16 a while back. I doubt they're the ones storing passwords in plaintext though.