mschwaig

14 ms·

1. 121.▲
   by mschwaig 12y ago

   I think this problem can also be mitigated by the additional parameters in the reset link like the expration time. If these parametes differ you actually dont get to hash one thing and test it against all currently valid reset URLs to make
2. 122.▲
   by mschwaig 12y ago

   If you include the current password hash when calculating the hash for the reset link and you also include a random salt in your password hash, the reset link will become automatically invalidated because the password hash will change when
3. 123.▲
   by mschwaig 12y ago

   I think this is more like Chevy stopping to produce all the parts on their own and instead starting to use trusted parts provided by third parties which the rest of the industry already agrees on using. Buying the manufacturer of one such p