Why can't they just say they invalidated my password
post
Me right now with my healthcare provider. I answered all the questions wrong. On hold now for 33:32 hmb.
Or how about:
Please fill out your account details in order to log in.
Me: Types mail and password.
A verification mail has been sent to your mail. Please provide the code within 10 seconds or the code will no longer be valid.
At that point I just ask what's the reason to have a password at all? I despise mail-forced verification, it serves no purpose other than for the initial account setup and potential password reset.
I treat my computer with respect. The RAM sticks I have in there are all I have to retire on.
The slop is strong in this one
It really isn’t.
Looking at the edge of the table/desk at the cat, I’d say it is. But it might be traditional easy photoshop, fair enough.
I have never seen ai make a keyboard with keys that straight.
it's beyond amusing when people are wrong with what is or isn't slop...
Is this community just ai-generated memes?
"we just had a breach and soft forcing users to change their credentials"
IT devs who wrote oldpassword===newpassword checks should be tarred feathered hung drawn and quartered, in that order.
Nah, use a password manager and stop using that garbage collection of characters you’ve used for over a decade.
Password managers don't protect against passwords being stored in plaintext on the server side... Which my main comment implies.
If I had to implement a same password check, I would simply check if the new password works to authenticate the user. If it doesn't, then it's different. There's no reason or excuse to ever store plaintext passwords.
I'm no expert either but IIRC best practice is to use salting and hashing. basically together with your password is a long string of random characters generated by the site (the salt). the two are combined and put into a a cryptography hashing algorithm to give you a hash. the website only stores the salt and the hash. every time you log in you provide the password for the whole thing again and if the output hash matches the stored one then it knows your password is correct, without ever having to store it in any record.
Yeah! They should be checking a list of old hashes, so that none of the previous passwords can be used!
They should also fire the ones who make it so the correct password fails when you enter it.


all 19 comments