Comment on Larion Studios forum stores your passwords in unhashed plaintext.

inclementimmigrant@lemmy.world ⁨1⁩ ⁨year⁩ ago

• JackbyDev@programming.dev ⁨1⁩ ⁨year⁩ ago

  Encrypted passwords are still an unacceptable way to store passwords. They should be hashed.

  source

  • Cloodge@lemmy.world ⁨1⁩ ⁨year⁩ ago

    (and salted before hashing.)

    source

    • Dicska@lemmy.world ⁨1⁩ ⁨year⁩ ago

      And marinated in butter milk.

      source

      • Cloodge@lemmy.world ⁨1⁩ ⁨year⁩ ago

        Peppered if you’re feeling extra

        source
  • Michal@programming.dev ⁨1⁩ ⁨year⁩ ago

    Just because they send out the password does not mean it’s not hashed. They could send the email before hashing.

    source

    • JackbyDev@programming.dev ⁨1⁩ ⁨year⁩ ago

      You’re correct and after reading more of the thread I saw OP say this was sent immediately after registering. I don’t have reason to believe it is stirred in plaintext unless they’re storing s copy of every email they send.

      source
• jeeva@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Would you accept “in a way that can be reversed”?

  source

  • tonkatwuck@lemmynsfw.com ⁨1⁩ ⁨year⁩ ago

    It’s possible that this email is a result of forum user creation, so during that submission the plaintext password was available to send to the user. Then it would be hashed and stored.

    source

    • Serinus@lemmy.world ⁨1⁩ ⁨year⁩ ago

      I don’t know why you’d give them any benefit of the doubt. They should have already killed that with this terrible security practice.

      But yeah, sure, maybe this one giant, extremely visible lapse in security is the only one they have.

      source

      • tonkatwuck@lemmynsfw.com ⁨1⁩ ⁨year⁩ ago

        I’m just explaining how user authentication works for most web applications. The server will process your plaintext password when your account is created. It should then store that as a hashed string, but it can ALSO send out an email with that plaintext password to the user describing their account creation. This post does not identify that passwords are stored in plaintext, it just identifies that they email plaintext passwords which is poor security practice.

        source

        • -> View More Comments
• Serdan@lemm.ee ⁨1⁩ ⁨year⁩ ago

  Passwords shouldn’t be stored at all though 🤷‍♂️

  source

  • Vlixz@lemmy.world ⁨1⁩ ⁨year⁩ ago

    You mean plaintext passwords right? Ofcourse then need to store your (hashed)password!

    source

    • Serdan@lemm.ee ⁨1⁩ ⁨year⁩ ago

      The hash is not the password.

      source

      • Vlixz@lemmy.world ⁨1⁩ ⁨year⁩ ago

        My bad! I just misunderstood ^⁠_⁠^

        source
    • jmcs@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago

      If they stored the hashed password this thread wouldn’t exist.

      source
    • TheFogan@lemmy.world ⁨1⁩ ⁨year⁩ ago

      Point is, a hash isn’t a password. giving the most you don’t need tech knowledge analogy, it’s like the passwords fingerprint.

      The police station may keep your daughters fingerprint so that if they find a lost child they can recognize it is your daughter beyond any doubt. Your daughters fingerprints, is like a hash, your daughter is a password.

      The police should not store your daughter… that’s bad practice. The fingerprints are all they should store, and needless to say the fingerprints aren’t your daughter, just as a hash isn’t a password.

      source