5 ms·
No, It does not mean that the password is stored as plaintext. Simply keep a flag for "UpdatedRecently?", if the flag is false, then not only should the first h
by Cerium 12y ago
No, It does not mean that the password is stored as plaintext. Simply keep a flag for "UpdatedRecently?", if the flag is false, then not only should the first half of the input correctly match the hash, but the first half the input should match the second half.
- ChristianBundy 12y agoHow is that helpful for mitigating security issues though?
- Aldo_MX 12y agoUnless you are being specifically targeted (ie. the attacker knows that you have to repeat the password twice), you mitigate the easiest possible attack: user/password combination from a stolen database. Although I suppose this was done to force the users to change their password.
- tempestn 12y agoBecause it annoys the holdout users into changing their passwords.
- oxryly1 12y agoBack in my day (old man grumble) the system would force you to change your password on next login. Simple, effective. This approach is just a dumb prank.
- jarek 12y agoI dislike being forced to change password without notice, I need some time to come up with a secure, typeable one. Change on next login just results in me reusing an old password or adding a "2" to the current one.
- deleted 12y ago[deleted]
- WallWextra 12y agoDo you consider this likely?
- Cerium 12y agoI'd probably flip a coin.