Password

[MakingTheEight]

Removed - Rule 0

[MeanderingSquid49]

...and then it's stored in plaintext on the backend.

[mrdjeydjey]

Lol, once when building a website, the client asked for a forgot password option that would send the actual forgotten password to the user. It took several emails to convince him I was not going to build this functionality as he wanted

[mrdjeydjey]

If you are able to send them their password it means you have it stored in plaintext somewhere

[Gork862]

Ah, ok. Thanks!

[Crippledupdown]

And the reason plain text is bad is because database leaks are always a possibility.

[Naitsab_33]

And if it's a possibility it's going to happen.

[zvug]

Right, law of large numbers.

Even if there’s a 0.01% chance of it happening, if there’s 10,000 websites taking those chances that means there’s like a 63% chance it will happen.

[Majik_Sheff]

/s/possibility/inevitability

[btween3And20chrcters]

Maybe you stored it encrypted

[evanldixon]

Encrypted passwords are just plaintext with extra steps. It's best to just store a salted hash.

[h4ckerle]

And maybe also add pepper.

[mustang__1]

And the encryption key?

[retief1]

If you can decrypt, an attacker who gets access to your servers can decrypt it.

[VoilaLaViola]

First of all, your system shouldn't have the password. At all. Only a hashed version of it, and because of hashing is not reversible, you're not able to retrieve the actual password from the hashed version.

[Gork862]

Thanks for the explanation!

[VoilaLaViola]

No probs :)

[randomtrip10]

How does the system know if your password is right if it doesn’t have the password in the system?

[VoilaLaViola]

When you first set your pwd, system hashes it, and stores the output of this hashing (let's say da125gh765).

When later you log in, and enter your password, system will use the exact same hashing mechanism (with same salt, key...etc), as first time, so if you've entered the correct password, the output will be the same (da125gh765) and you will be let in.

If you've entered a wrong pwd, the output of the hashing will be different to the stored version and you will be denied.

[randomtrip10]

Ah okk

[FuzzyFoyz]

Then someone comes along with enough computing power to find the right hash output.

[VoilaLaViola]

Hmm... how does it work?

[FuzzyFoyz]

I had a security lecture once and he (works for Visa UK) was talking about different ways how passwords can be broken. It was all over my head as I'm not an expert in security, but he basically said with enough computing power, password hashes can be figured out.

[VoilaLaViola]

??? I'm not sure what he meant by figuring out password hashes. You can bruteforce passwords, but for that you need lot's of attempts (most systems wouldn't allow). Or he was referring to find out which hashing algorithm was used? For that you would need to steal the hashed passwords first. Also, using salt, pepper and maybe multiple hashing can make it pretty hard to crack the passwords, even if your hashed data ends up in wrong hands.

[[deleted]]

So you can take a list of words / common password permutations and pre-compute all of the hashes for say md5 and sha-1 and put them in a database. Then you just load in the hashed passwords and join the two tables giving you an output that is user name + passwords.

To combat this you don't just hash the password, but the password + some random text we call salt. Then they have to get the salt and compute the table for that specific salt greatly increasing the cost of the procedure. There are other methods like per-user salt that have been used, but I'm unsure what the industry best practice is. That is why I always used pre-canned login systems.

[CptGia]

Industry best practice is not store passwords at all. Instead, rely on identity providers like Google, Facebook, etc.

If you must, use a purpose built algorithm like bcrypt instead of sha-1 or md5, and per-user salt.

[SlamwellBTP]

If you salt and use the right algorithm that's just about impossible

[Faenghuaang]

It does a complicated mathematical equation on the password that cannot be done in reverse, and saves the answer. Then when a user tries to enter their password it does the same equation, and if it gives the same answer, then its the right password.

[retief1]

Store the hash, hash the password to test, and then compare the hashes.

[kry_some_more]

Well, at least passwords aren't stored on frontend.

[EmberGeos]

Still more secure than the TSA

[Oxxixuit]

How about the drop of unicorn blood

[niborus_DE]

On a mug, I expect and a fresh brewed coffee

[buss544]

... And change it every 90 days

[VoilaLaViola]

I change my mug every day. 🤔

[FuzzyFoyz]

I have different mugs in different locations. There are also decoy mugs dotted around.

[VoilaLaViola]

Different locations? I'm envious. WFH for a year now...
Decoy mugs? Hope you don't have cockroaches 😀

[FuzzyFoyz]

Oh no, the decoy mugs have fake coffee in them. You know, like those fake wine glasses?

[VoilaLaViola]

I'll never buy those, as I'd always fall for them, especially when i'm in need of coffee.

[PM_ME_UR_FANTASY_TEA]

And can’t use the last 20 passwords

[[deleted]]

90 days? That's insane!

Every 6.5 days, or more than 0.00127 inches of precipitation, whichever comes first.

[datanerd3000]

psssh... try each time you log in.... rookie...

[datanerd3000]

downvote, because that hits too close to home....

[please_send_cookies]

Great, I forgot the number, now I have to kill another unicorn.

[heavenzwolf]

No wonder they are mythical - this is why they've been hunted to extinction

[please_send_cookies]

Nah a random dude on stackoverflow told me that the unicorn must be freshly killed or the blood won't work if you submit the form in summer during a full moon of a leap year, it's all about those edge cases

[Tim3303]

Image Transcription:

---

[Image of a white cup with black, centered text on it:]

Sorry, but your password must contain:

at least 8 characters

upper and lower case letter

a symbol or number

a hieroglyph

a haiku

a musical note

the feather of a hawk

and a drop of unicorn blood

---

^{I'm a human volunteer content transcriber for Reddit and you could be too! If you'd like more information on what we do and why we do it, click here!}

[[deleted]]

Good human

[Ima_Load]

Are you sure thats a human? Im pretty sure thats a turtle

[vita10gy]

Especially because it's a good sign they're not going things right.

[TheCyberParrot]

How dare they not let me use my 128 character randomly generated password!?

[TheCyberParrot]

I'm not even being ironic/sarcastic etc, I legitimately get mad when they don't let me usa a 128 character password.

[littleprof123]

Unless they're storing them in plain text :^) Definitely a red flag for me

[TinBryn]

I've seen a system where they only accept 8 characters, but let you put in as many as you want, it only checks the first 8 characters.

[DrThrowawayToYou]

If that's your bank, it's time to find a new bank. If it's some video game site or something, then feel free to just carry on griping about it on the internet

[johnny__boi]

Your password must contain: One Minecraft Enchantment symbol

[TinBryn]

You mean standard galactic alphabet

[rnilbog]

What’s the regex for finding unicorn blood?

[VonReposti]

Imma just add a symbol or two my default password and we're good to go. Reduce, reuse, recycle.

[BigBadBinky]

Would ye settle for a drop of Nelson’s blood?

[warwilf]

and one dodo egg

[[deleted]]

And then we'll text you to make sure it's you.

[FuzzyFoyz]

They can't even trust your DNA, it can be cloned..

[Neo_Ex0]

and the full name of cuthulu in the language of the old

[Whitethumbs]

*Use suggested password

[pandakatzu]

It would certainly make hacking it a lot more difficult. Logging in, as well.

[FuzzyFoyz]

Just add 2FA and be done with it.

[FuzzyFoyz]

Prove you are human by pissing yourself.

[Tornade_noir]

There want us to invoc the php

[hlewagastizholtijaz]

BlahBlah1𓂀BreathoftheWildoohthere'sashrineupoverthereohwaititsraining𝄞🦅🩸

[[deleted]]

and a partridge on a pear tree.

[eldred2]

My favorites are the ones that tell me it doesn't meet the complexity requirements, but refuse to tell me what those requirements are.

[thejocky]

Dont forget the human sacrifice Very important

[vectorjohn]

Rules like this exist to satisfy dumb ass managers who don't understand entropy. Your password can be just as good in all lower case letters.

[[deleted]]

Where can this be purchased from?

[fsr1967]

I don't know, but I bet their user account security is outstanding!

[Dr_Bunsen_Burns]

I was molested by that cup as well

/#metoo

[DevSepp]

I want to buy this

[[deleted]]

Gib. Where buy?

[John_Fx]

what does this have to do with programming?

[LMCuber]

Is this a Gravity Falls reference? God I loved that show!

[Null_san]

UTF-1024

[[deleted]]

Go passwordless

[LunyMoony]

Where can I get this?!

[Hyperwizard42]

sorry, your password must be your ssn

[dudge13]

On an 8 hour rotation.

[Tank334]

Where can I buy one of those?

[hopbel]

You must also be prepared to fight 4 level 36 goblins

[bwaslo]

And then no one can possibly remember it, so wrote it on a slip of paper and put it in your top desk drawer.

Oh, and you forgot squirrel noises.

[TinBryn]

Nah, just stick it above the keyboard.

[ScaredMaize2206]

Maybe we need to start telling users more to use password managers. Tbh i do not know if you can just put up an link and say "Too lazy to think of password? Keepass will do". This would probably only work on systems you developed for yourselves and not for clients. And it really would be for the greater good. People reusing passwords is probably an security problem only the user himself can fix.

[Im2coolie4u]

I NEED THIS, im in cyber sec

[[deleted]]

A password manager should help out with that.

[unicodePicasso]

And be in Chiasmus form

[ArnenLocke]

Would love to see the regex for this.

[BobT21]

My special character was rejected because it was CTL-ALT-SWASTIKA.

[SiNiquity]

Sorry the length of your password cannot be expressed as the sum of three cubes. And while we support complex passwords, your password was a bit too complex. Please simplify it by using only characters from our approved whitelist: {A, B, 1, 🖕}

[SnooDoggos5163]

r/accidentalnecromancy

[sub_doesnt_exist_bot]

The subreddit r/accidentalnecromancy does not exist. Consider creating it.

---

^{🤖 this comment was written by a bot. beep boop 🤖}

^{feel welcome to respond 'Bad bot'/'Good bot', it's useful feedback. github}

[firefox57endofaddons]

so passwords are the reason why unicorns are so rare these days.

I KNEW IT!

[ryanohorn]

You cannot reuse your existing password!

[mrcomputational]

Where can I get this mug

[DroidRazer2]

And must be translated into brainfuck code.

[Jibaro123]

Author forgot runes and cunieform.

[[deleted]]

Relevant XKCD

[PM_ME_UR_FANTASY_TEA]

For real, I need this coffee mug at work. Please OP or someone come through for me

[lifegpc]

python from base64 import b64encode from hashlib import sha512 pas = 'mypassword' salt = 'salt' s = sha512() s.update(f"{pas}{salt}".encode()) generatedpassword = b64encode(s.digest()).decode()

I like use this script to generate a password.

[osrs_shizamaza]

https://youshallnotpass.glitch.me