196
If your computer was alive you would strangle it (lemmy.world)
submitted 2 days ago by to c/iiiiiiitttttttttttt@programming.dev
11 comments fedilink hide all child comments
 

cross-posted from: https://lemmy.world/post/53941877

you are viewing a single comment's thread
view the rest of the comments
[–] 13 points 2 days ago (6 children)

IT devs who wrote oldpassword===newpassword checks should be tarred feathered hung drawn and quartered, in that order.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 3 points 2 days ago (3 children)

    Nah, use a password manager and stop using that garbage collection of characters you’ve used for over a decade.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 2 days ago* (2 children)

    Password managers don't protect against passwords being stored in plaintext on the server side... Which my main comment implies.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 days ago (1 child)

    If I had to implement a same password check, I would simply check if the new password works to authenticate the user. If it doesn't, then it's different. There's no reason or excuse to ever store plaintext passwords.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 days ago

    I'm no expert either but IIRC best practice is to use salting and hashing. basically together with your password is a long string of random characters generated by the site (the salt). the two are combined and put into a a cryptography hashing algorithm to give you a hash. the website only stores the salt and the hash. every time you log in you provide the password for the whole thing again and if the output hash matches the stored one then it knows your password is correct, without ever having to store it in any record.

  • permalink
  • fedilink
  • source
  • parent