4 ms·
well .. that bugfix have associated a few risks.. 1. let's suppose a user have a password: (note the space) " 123" 2. also you store the password using s
by _lce0 11y ago
well .. that bugfix have associated a few risks..
1. let's suppose a user have a password: (note the space)
" 123"
2. also you store the password using some hashing function, which prevents you from knowing the password.
3. two weeks later the bugfix goes live, the user cannot longer access the service.
Also, you cannot easily estimate how much benefit/annoyed users your _fix_ will endup having .. which makes it a higly risk change.
- kosinus 11y agoAbsolutely true for regular passwords. In the specific case of the blog post, it can work however, because it's just the numeric two-factor part.
- epochwolf 11y agoThis is going to sound a bit horrible... Fixing the space issue will help more people than it hurts. People that have spaces at the beginning or end of their password can simply reset their password or call customer support. Users forget or mistype passwords all the time.
- deleted 11y ago[deleted]
- TheLoneWolfling 11y agoThis is about 2fa, not passwords. With 2fa, you control the allowed character set, and as such can make sure that what you mention cannot happen. Mind you, 2fa is stupid for a whole lot of other reasons, but that's another matter.