Comment on Larion Studios forum stores your passwords in unhashed plaintext.

• Cabrio@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Still bad practice and a security vulnerability at best. Email isn’t E2E encrypted.

  source

  • beefcat@lemmy.world ⁨1⁩ ⁨year⁩ ago

    there is no possible way to handle sensitive data without storing it in memory at some point

    it’s where you do all the salting, hashing, and encrypting

    source

    • JackbyDev@programming.dev ⁨1⁩ ⁨year⁩ ago

      emailing out credentials like this after sign up is certainly not best practice,

      Understatement of the year right here. Everyone in this thread is more interested in dunking on OP for the few wrong statements they make rather than focusing on the fact that a service is emailing their users their password (not an autogenerated “first time” one) in plaintext in an email.

      source
    • RonSijm@programming.dev ⁨1⁩ ⁨year⁩ ago

      there is no possible way to handle sensitive data without storing it in memory at some point

      Since we’re nitpicking here - technically you can. They could run hashing client side first, and instead of sending the password in plain-text, you’d send a hashed version

      source

      • beefcat@lemmy.world ⁨1⁩ ⁨year⁩ ago

        but then you expose your salt to the public

        source

        • -> View More Comments
      • ilinamorato@lemmy.world ⁨1⁩ ⁨year⁩ ago

        This opens up the possibility of replay attacks in the case of data breaches, though, and those are much more common than http mitm attacks (made even less likely with the proliferation of https).

        I’m not entirely sure whether hashing twice (local and server) is wise, having not thought through that entire threat vector. Generally I try to offload auth as much as I can to some sort of oauth provider, and hopefully they’ll all switch over to webauthn soon anyway.

        source

        • -> View More Comments
  • oneiros@lemmy.blahaj.zone ⁨1⁩ ⁨year⁩ ago

    Stored in memory is still stored.

    Given what I know about how computers accept user input, I am fascinated to hear what the alternative is.

    source

    • Cabrio@lemmy.world ⁨1⁩ ⁨year⁩ ago

      You have the text input feed directly into the encryption layer without an intermediary variable.

      source

      • frezik@midwest.social ⁨1⁩ ⁨year⁩ ago

        Are you suggesting to do all this on the frontend before it goes to the backend?

        source

        • -> View More Comments