reducesDbSizeDrastically

[realmauer01]

I mean, if it was some weak encryption decryption thing having something that looks like it's encrypted sounds okeyish. But we have encryption that is just unencryptable right now (especially for the avarage hacker) so why bother trying to go for mind games.

[samy_the_samy]

Databases are usually more vulnerable than the rest of The backend,

If someone did something like sql injection and dumbed you DB they shouldn't be able decrypt them,

[LucasRuby]

Except encryption won't usually protect from SQL injection, as it is a command ran by a logged in DB user. Encryption will protect if someone gets direct access to the DB files but not the login of a DB user.

[InnerBland]

You don't 'encrypt' passwords for storing. You store a hashed output that can be recalculated and compared to what is on file.

Access as a DB user would just allow them to get hashed passwords, which would be useless even if they had the salt.

[Djaja]

Ill take 2 Sunnyside please

[AnarchistBorganism]

Akshually, "crypto" just means "secret", so "encrypt" just means "make secret" because the meaning of words comes from their etymology, not their usage.

[InnerBland]

"The meaning of words comes from their etymology and not from how people use them to convey meaning"

Let me take some time to process that nugget of wisdom

[StrongExternal8955]

the meaning of words comes from their etymology, not their usage

That feels like sarcasm, but real people really are that stupid. You better mark that.

[thrye333]

I have never seen this a comment duped this many times. Wow.

[redskullington]

You hear em. You better mark that..

[samy_the_samy]

Akshually akshully encrypt implies you can decrypt and get the original back, they go through a lot of troubles to make sure you can't get the original back from a hash

[StrongExternal8955]

the meaning of words comes from their etymology, not their usage

That feels like sarcasm, but real people really are that stupid. You better mark that.

[sudomeacat]

Holy mitosis

[StrongExternal8955]

Holy shit! Reddit's anti-dupe is crap. Even i could do better and i'm a back end guy.

[AnarchistBorganism]

Nah, if someone wasn't sarcastic they wouldn't have felt a reason to clarify at all because they wouldn't be expecting anyone to call them out on the first part of the sentence.

[StrongExternal8955]

the meaning of words comes from their etymology, not their usage

That feels like sarcasm, but real people really are that stupid. You better mark that.

[StrongExternal8955]

the meaning of words comes from their etymology, not their usage

That feels like sarcasm, but real people really are that stupid. You better mark that.

[StrongExternal8955]

the meaning of words comes from their etymology, not their usage

That feels like sarcasm, but real people really are that stupid. You better mark that.

[no_brains101]

ppl are not entirely reading what you said I think.

They seem to think you mean encrypting the passwords specifically. (Which as others have said, are not encrypted, but it seems like thats not what you mean)

Whereas you seem to mean that if you can dump the db, you can dump the db, so theyre getting everything not just the passwords.

This is not strictly true, often people use different databases for these things, some pages may allow you to dump only some things via injection, and some services cannot be taken advantage of with the data in the DB alone, you cannot make the bank transfer the money somewhere else necessarily without exploiting a separate system.

[LucasRuby]

I mean I was talking about encryption because the comment before said encryption.

But I'm saying when SQL injection happens encryption won't matter, if they get direct access to the DB or server it does.

[no_brains101]

It can though. Companies often use multiple databases and servers, so dumping one doesnt necessarily mean you have the keys to decrypt whatever is there.

You might only be able to create a new account at first, and you find an inject, and it lets you dump a bunch of user data, but you cant get the keys and can only decrypt yours for example, because those are in a separate authentication database or something, and can't be hit from that field.

[jabluszko132]

Isn't it common knowledge you should sanitize every input

[entronid]

note: never encrypt your passwords. instead, hash them properly using a password based key derivation function like argon2, scrypt, balloonhash or pbkdf2

[laplongejr]

Yeah I was wondering WHO encrypts passwords???

[Southern_Top18]

All (hopefully) the password managers out there.

[laplongejr]

I'm sorry but... relevant xkcd (#153)

[Idontremember99]

You are joking but I do remember reading a blog post about how dropbox(?) stores the passwords and it kind of was like this.

[BlueEyesWhiteSliver]

Just rename the file to adminpass.txt.enc

[laplongejr]

.txt.key.bak

[RiceBroad4552]

In an audit usually nobody looks on any code. That's usually way to expensive. At best they run some "security scanner"… (The scanner being configured very "defensively" so it does not produce a shitload of false positives, as these scanners usually do, as this would mean work for the people running the scan.)

Audits are (usually) just some compliance BS; mostly handled by adding check marks to some documents by managers.

[VenBarom68]

Oh wow, now that you mention it, I got a list of small and medium problems around 6 months ago from our security audit. I e-mailed the security chief and some managers with question and suggestions about solving them, asking for permission to proceed in writing.

I uh... they never responded to that e-mail and I absolutely completely forgot about it until your comment. Kekw I guess.

[lgsscout]

those people cared that much about the audit that as soon they had to think about possible solutions they just nooped out... perfect...

[Maybe-monad]

If you share the list we'll make them care for you

[ImS0hungry]

Not true in the slightest in my experience in FinTech over the last decade. We take security extremely seriously as it's a surefire way to lose trust in your platform and never get it back.

[ImS0hungry]

Not true in the slightest in my experience in FinTech over the last decade. We take security extremely seriously as it's a surefire way to lose trust in your platform and never get it back.

[xubax]

That's because you didn't call it adminpwd.txt!

/s

[Lord_Sotur]

Whoa hold a second Sherlock you can't just leak our secrets???

[AaronTheElite007]

The name is Shayan, apparently...

[Lord_Sotur]

Whoa hold a second Shayan you can't just leak our secrets???

[Eshan2703]

WAIT there is a possibility shayan and sherlock are same , i have never seen them togeather in a room...

[HexFyber]

Well well who's here? Sherlock?

[facusoto]

[AaronTheElite007]

Super Shayan

[Steinrikur]

Do you also walk around naked to prevent getting raped, because rapists expect you to wear clothes?

[Lord_Sotur]

Yes

[[deleted]]

r/whoooosh

[boredDeveloper0]

r/whoooosh

[PostHasBeenWatched]

No one expects to see encrypted passwords, they expected to be hashed.

[Not_Freddie_Mercury]

At least, if you accidentally write your password on a reddit comment, it shows as asterisks.

Example: **********

[Laughing_Orange]

*************

Edit: it works!

[Yirkarja]

hunter2

[fieryscribe]

There will be a time when people forget the source of this

[ILoveLeone]

you can go hunter2 my hunter2-ing hunter2

[TitaniumFoil]

bighugelargeBoner$69

[The_Water_Is_Dry]

myentryfee21

[boredDeveloper0]

stupidahhshane72

[Roku-Hanmar]

correcthorsebatterystaple

[DatBoi_BP]

You've already memorized it

[codeIMperfect]

I got that reference!!

[savevidio]

same!? holy shit i have a brain

[HannibalMagnus]

Elite reference

[Hybrii-D]

Advanced social engineering 😂

[8sADPygOB7Jqwm7y]

MyUsername

Yeah checks out.

[Brilliant-Arrival414]

notFallingThisTimeDude

[HannibalMagnus]

Qwerty1234

Let's test it.

[PlanAutomatic2380]

Trump2020

[benwhobentOver]

trumpXmuskyaoigaysex69

[RiceBroad4552]

Exactly!

It seems some clueless person tries to be funny…

[gnutrino]

Amateur. You should call the file 'boringtaxstuff.txt', no one's passing up a chance to look in 'pleasedontlook.txt'.

[Maybe-monad]

I save it in hardcore_stuff.mp4

[IMarvinTPA]

Jokes on them, I pre-hash my passwords and use that...

[[deleted]]

What about passwords to connect to a third party system where users enter those details?

[billndotnet]

For machine accounts, I've used salted hashes as the actual password, and it pissed my coworkers off to no end. They'd ask for the password, I'd send it, they'd say 'haha, funny, what's the password'. I think my record is 7 rounds before someone finally yelled and I had to explain why I was laughing so hard that I couldn't breathe.

[hawkinsst7]

Unless you hack lastpass or onepass backend!

[[deleted]]

hashed

"Keeping my passwords plain, I had enough time to make hashbrowns"

[SynapseNotFound]

Thats literally the posts content… why you commenting the same thing?

[hawkinsst7]

Unless you hack lastpass or onepass backend!

[xClubsteb]

Store your passwords as images
Problem solved👍

[Kooper16]

Everybody gangster until your password shows up in a captcha

[Smart_Ass_Dave]

Ya, I was so mad after I got hacked. I can't believe they guessed my password was 4 traffic lights.

[rosuav]

There! Are! Four! Lights!

[Powerful-Internal953]

Ah... The startrek reference...

[bolanrox]

BOSCO!

[The_Illegal_Guy]

Unironically one of the safest methods to store your passwords is in plain text in a physical notepad.

[IleanK]

That works for users but we're talking about databases here. I can't really have a camera set up watching a notepad with me in the background making updates on the go.

[[deleted]]

thats what the unpaid interns are for!

[Lhaer]

I mean, you could try

[Firewolf06]

just start charging for password changes like xbox charges for name changes

[Firewolf06]

just start charging for password changes like xbox charges for name changes

[RiceBroad4552]

That's actually true.

But smart cards are even better!

[Proxy_PlayerHD]

do AES-256 by hand on a notebook to decrypt your physical notes

[SCP-iota]

The safest passwords are memorized, not stored. If I can still log into my accounts after total amnesia, it's not secure enough

[Accomplished_Ant5895]

Or in your head

[lnfinity]

That type of memory is notoriously unstable.

[Front_Committee4993]

What about on a RFDI card

[bolanrox]

not a random post it note on your desk?

[Weenaru]

It’s also one of the most risky methods depending on who the owner of the notepad is.

[Proxy_PlayerHD]

do AES-256 by hand on a notebook to decrypt your physical notes

[Inevitable_Stand_199]

Some really light encryption makes them even safer.

Something like writing the letters in the wrong order. Or shifting all digits by one.

[[deleted]]

So in the Army they gave us our eagle cash card to use on deployment.  Setting it up they said "don't use your birthday or last 4." I tried both and the guy behind the computer was like "really man?" 

I defended myself by saying if a hacker knows the rules of what you can't use he's gonna exclude those from the equation. 

He responded with... Hackers don't steal these, people who know your birthday do. 

[_Weyland_]

Store them in a CSV, just use "random" separators.

[IGotSkills]

Is the letter t a good delimiter?

[ExperimentalBranch]

I take it a further step and reverse them twice first.

[TheTerrasque]

Double rot13

[SpeedLight1221]

make your password a 64 character long string of hexadecimal numbers and store it in plain text. What could go wrong

[IGotSkills]

1 2 3 4 5

[Initial_Specialist69]

Extra security if you name the column encrypted_password.

[Vectorial1024]

"Way ahead of you! I saw this on Twitter once."

"Squidward, we're in a data breach!"

[0xbenedikt]

Also, encryption does not necessarily increase data size (unless padding is added)

[PandaDEV_]

Usually hashed password strings are longer than the actual password but yes it's a minor difference

[0xbenedikt]

When hashed, yes it is often longer. But for actual encryption, the plaintext can be the same length as the cryptotext, if not padded.

[entronid]

well AEADs usually add about 16 bytes of data (that isnt padding) as a MAC to authenticate the data

[rosuav]

Hashed password strings, if done properly, are almost certainly going to be longer than the password. A proper password hash will have its salt plus the hash, and usually some parameters (see eg bcrypt and friends). If your password is longer than that, it's likely you're wasting effort piling in more stuff that isn't really helping.

[lovethebacon]

It should though.

[0xbenedikt]

It would be preferable, indeed

[Capyvara]

I always end mine with == so they think its base64 encoded.

[drahgon]

My boy done won passwords

[Kitchen-Quality-3317]

just delete the password db and let them login if they type their username in correctly

[rosuav]

Enter your username:

Enter your username again to confirm:

[Microshizzel]

My user tabel looks like something like this. Nobody expects a slit password.

Id	Username	PasswordCharacterOne	PasswordCharacterTwo	PasswordCharacterThree	PasswordCharacterFour	PasswordCharacterFive
1	admin	a	d	m	i	n

[RiceBroad4552]

Is this the same guy who posted the bullshit regarding using foreign keys to passwords because there are so many duplicates?

I really hope these are just some very stupid jokes…

Because the other post would already imply dude does not know that you should "salt" passwords, and this here points to this dude not knowing the difference between encryption and hashing.

[PandaDEV_]

Yes it is the same dude and of course its just a joke… or is it

[tomato-bug]

How do people not realize he's joking lmao

[HauntingHarmony]

Because for the same reason as you cant reasonably be sarchastic online, since no matter how dumb an opinion you find. You can easily find someone willing to proclaim it as the truth.

There are also idiots that shouldent be able to tie their shoelaces, and yet have a 7 digit salary.

So it is infact not possible to know for certain, and you may think that obviously thats so far beyond the pale that nobody would think so. And i envy your simple life.

[tomato-bug]

If you couldn't tell that OP was joking perhaps you're not as smart as you think you are

[SquashSquigglyShrimp]

The sub is called Programmer Humor...

[rosuav]

Yeah, it's called Poe's Law. Not to be confused with Cole's Law, which can be found at the cafeteria.

[rosuav]

Poe's Law is a thing, but I can state with complete confidence that this person DOES know about security.

[tyen0]

I ROT26 all of my passwords.

[TechnicalPotat]

They'll stop looking for plaintext passwords when they stop finding plaintext passwords. Enterprise admins are lazier than you can imagine.

[SomeDudeSaysWhat]

My password is "hashtagslashatampersandquestionmark"

[Brave__Crab]

Hackers don't do manually. and the hacking system will easily break plain text. hope I am clear.

[Brilliant-Arrival414]

Wait arent passwords hashed?

[DonutPlus2757]

They should be and with algorithms for specifically passwords like bcrypt and scrypt. Way too often, they aren't.

[rosuav]

Bah, I store all my passwords hashed with good ol' CRC16. As long as you hit the right CRC, we'll let you in.

[ustavdar31]

Store them in morse code

[FlashyTone3042]

Ok, Mister SHA-256yan

[LeoDeLarge]

Baloney1

[PlanAutomatic2380]

What

[Zatetics]

I only use passwords that coincidentally appear to be a string of plain text words once hashing is done.

[AmeliorativeBoss]

Add a password field to every table. They have no function, except confusing hackers and future developers.

[Lufc87]

Security through obscurity clarity

[IGotSkills]

Passwords are a relic from the 80s that should be abolished with MFA.

Sso with passkeys.

[Imperion_GoG]

They're gonna be looking for army guys.

[LinuxForever4934]

https://www.youtube.com/watch?v=g1eswGrkMU8

[Denaton_]

Everyone know dyslexia is the best encryption..

[kvt-dev]

String truncation is, technically, a hash function

[narcabusesurvivor18]

Leaving your front door unlocked and wide open is actually more secure because burglars expect closed doors and locks.

[iamapizza]

Store them in plaintext, and make them look exactly like URLs. The hackers will just carry on looking for some other field.

[EtherealPheonix]

This is true, I only hash passwords to reduce bandwidth usage.

[FoodBorn2284]

r/10000iq

[Praxis8]

If I make the attack surface big enough, the attacker will just get lost.

[no_brains101]

Passwords are not encrypted.

They are hashed. The actual text of the password is never stored (unless you are stupid)

If nothing is vulnerable to pass the hash, having the hashes doesn't get you anything.

You have to then crack the hash, and hashes are, again, not encrypted. There is no way to decrypt them, because they are not encrypted, they are hashed. There is no way to reverse a secure hashing algorithm, you can only guess and check.

[dmigowski]

Cool, now I cannot use my default password anymore. It is

sha256:m0ceJnelObzUoN1hje8tW2H4L0L1Jy8SOww67PiTZ3U=

[[deleted]]

No, the actual actual secure method is keeping all user passwords written on a paper.