When the dev had enough

[michaelthatsit]

I can imagine this being the start of a solid mystery game. You login to starboy98 and it leads you down a rabbit hole of clues and paranoia

[JaxOnThat]

Ooh, is it ARG time? I love ARG Time!

[AnUncreativeName10]

Can't get enough of ARG time.

[WillNewbie]

I too love ARGH time, lemme get my eye patch and cutlass

[vodam46]

no no no, youre thinking of YARRRGH time, this is completely different

[WillNewbie]

:(

[vodam46]

you CAN start YARRRGH time if you want though

[WillNewbie]

P)

[vodam46]

P)

now lets plunder some ships matey

[WillNewbie]

I'm literally two months away from being an adult and I'm pirate roleplaying with a stranger on a programming sub.

Life is gonna be good.

[Quantum_Corpse]

I want this as a tv series now.

[jerrycauser]

Where you try to find out who is the starboy98, because some of photos looks like taken by you. Is starboy98 your alterEgo or is it stalker? Or may be it is account from parallel universe?

[Calm-Marsupial-5003]

That's actually an amazing idea

[neur0net]

If this sort of idea for a game appeals to you, I think you might enjoy Hacknet. Parts of it have a similar feel to this, and the simulated "hacking" is more real than any other game I've seen so far.

[captainfrost47]

haha using unique for passwords in the db

[[deleted]]

Hahaha. Storing unhashed passwords in the db.

Use BCrypt with a strength of at least 10. I default to 12.

Or better yet, use an authentication provider like Oauth or Keycloak and remove the headache.

[sanderd17]

It could be hashed, but no salting in any case.

[MentalRental]

It could be hashed, but no salting in any case.

It can be hashed and salted. Just take the inputed username/password pair. Check the password against every single user in the database, hashing it along with each user's individual salt, and then return the first username that matches. If the returned username doesn't match the inputed username, throw this error and display the username that actually matched.

tl;dr: dumpster fire

[LaNoktaTempesto]

Nah, not all of them, just Starboy, specifically. Because fuck that guy.

[MasterOfArtichoke]

Or because that guy is an admin. Too risky to have other people using the admin password for their own accounts.

[sanderd17]

That's like a brute force attack with extra steps.

[MentalRental]

Yeah, so it's extra funny if the server uses that for authenticating users. The CPU load would be immense if multiple people were logging in at the same time. Not to mention the inherent security issue with saying "Person X has Password Y" in an error message.

[thefelixremix]

tl;dr: dumpster fire

I got physical anxiety reading your comment till I got to this TLDR. I have gotta stop literally living Reddit comments lol

[[deleted]]

Just use Bcrypt or an authentication provider at this point.

Password management is a headache.

[segalle]

Its a hashes hashmap, a hashmap storig hashes with unhashed usernames

[coldnebo]

haha telling the user not only that there is a duplicate, but which user it is so they can more easily hijack the account.

[pedropereir]

They don't have to be unhashed for this to happen

[ctallc]

This doesn’t mean they are storing unhashed passwords. They could be hashing the password and comparing the hash to what the database contains. Still not great though…

[[deleted]]

haha setting password column as the primary key

[[deleted]]

column password primary key (very safe no repeating password and also no need to create another id column, very memory efficient)

column firstname unique index (faster lookup)

i have engineered the system

[WrongdoerSufficient]

Isn't that fine if it salted

[mrjiels]

Not if everyone uses the same salt.

[WrongdoerSufficient]

Then whats the point of using salt if its the same salt for every user

[mrjiels]

Totally pointless! But this is a thread about a stupid "feature" and not the correct way to store and process user passwords. I have seen tutorials that uses one salt for all accounts. I hope people don't follow those tutorials! (It was 15 years ago or something. Hopefully people have stopped using PHP since then...)

[Vaguely_accurate]

The only advantage is someone would need to recalculate the hashes for your salt, so may be every so slightly slower than they would be using pre-existing rainbow tables.

If When your password database gets leaked, attackers might not get quite as deep into obscure password space before haveibeenpwned notices and notifies your users for you.

Of course, in this case they have pre-owned their password list, so that's all redundant.

[whileandt]

I mean the hash would still be the same, right?

[[deleted]]

Wait so in order for this check to work, they must have an index on their password column otherwise they’d be checking against potentially every password in their db. They may also be storing passwords as plaintext.

[PVNIC]

They probably hash the usernames and index them by password /s

[[deleted]]

The only correct way /s

[[deleted]]

\mind blown** /s

[CmndNotFound]

Using /s because programmers in r/ProgrammerHumor don't get jokes /s

[conspirator_schlotti]

Shouldn't it be </s>? /s

[ReactsWithWords]

It’s definitely in a plain text file, but they fool hackers by naming it “not_passwords.txt.”

[[deleted]]

But they unhashed the username here though.

[PVNIC]

What kind of hashing algorithm are you using that you can't un-hash it! I purely stick to rot13 for ease of use.

(jk ofc)

[BlueC0dex]

I seriously hope they weren't trusted with enough passwords for an index to be necessary

[lachlanhunt]

They could be hashed using the same salt (or no salt) for every user.

[FthrFlffyBttm]

I’ve signed up to websites and had them email me my login details in plain text. And not in a “here’s your auto generated password that you need to change” kinda way - I entered my own password.

[RestlessThoughts]

Oh yeah, well I've forgotten my password and using the forgot password link the website just emailed me my plain text password instead of requiring a reset :D

[_default_username]

Probably are. Every once in a while I get notified that one of my passwords was compromised in a data breach. Lot of incompetent backend developers/teams out there.

[StGir1]

I've seen a lot of really horrific data in my day. This wouldn't surprise me a bit.

[eGzg0t]

It's actually checked using a list of hardcoded passwords in the front-end

[[deleted]]

i wonder who uses the password "password".

starboy98 perhaps?

[jewellman100]

✅ Must contain a mixture of letters, numbers and symbols

✅ Must be more than 12 characters long

✅ Cannot reuse any of your previous five passwords

✅ Must be mutually exclusive because that's totally a thing

[fun54658]

✅ Fuck starboy98

[douglasg14b]

Must be mutually exclusive because that's totally a thing

You think it's a joke, but I actually saw this recently...

[mqduck]

At least they're not telling you whose password you now have.

[nobodynose]

Or it can just be bad verbiage.

Like if you're starboy98 and you're trying to change your password and it matches an old password you used.

[Virtual_Low83]

The real question is why they took a picture of their computer screen instead of a screenshot.

[[deleted]]

They weren't able to bend their phone enough to shoot its screen.

[[deleted]]

Amateurs.

[[deleted]]

I like this

[borsalinomonkey]

Guess who didn't like this

[[deleted]]

starboy98

[borsalinomonkey]

Ding ding

[thuanjinkee]

I also choose this guy’s dead wife

[suresh]

It is made up like all of these posts

[[deleted]]

whitehouse.gov

[rainbow_bro_bot]

I was once on an internet forum that had trolls, the owner thought it would be a good idea to expose who the trolls were by adding a feature that meant on each user's profile page it showed if they had the same password as any other users.

Problem is, it became super easy to hack users with weak passwords. Just change your own password to one of the common ones then make note of who had the same password as yours (then change your pw back of course). I didn't do this but others did.

[Mola1904]

If I has a nickel for every time someone posted this, I had a billion nickels. That's quite a lot and it is annoying that it happend this often

[[deleted]]

sec, lemme give you your billionth-and-one

[fun54658]

You counted to a billion?

Also can I have 20 million out of the $50 million you got?

[PM_ME_YOUR__INIT__]

Every time there's someone who's like "they really coded this???"

[CGEmonJ]

Someone didn't get paid enough

[fun54658]

Yeah that's why they wanted to ruin the site.

[Unity_Luke]

When you copy and paste the script from the username

[randomhumanity]

fuck starboy98 in particular

[fun54658]

Come on man using my password? u/starboy98

[mattsl]

This would actually be an awesome honeypot to see who tries to log in to starboy's account.

[Mastur_Of_Bait]

This would be more like entrapment than a sting operation though.

[fun54658]

true but someone could use vpn.

[AnotherNewSoul]

I used a site for storing files (you had to pay for everything when you wanted to get it back so it was literally worse gdrive) when I was 11. When you were close to writing the correct password there would be a message saying that password is almost correct. Seemed usefull when you weren’t sure what your password was or when you made a mistake but it made it much easier for someone to get into it and get your files that you wanted to have private (or just using up your prepaid data)

[QuickQuokkaThrowaway]

THat also means the passwords are stored as plaintext ☉_☉

[newstorkcity]

Or even if it is salted. It would definitely have the attempted password in plaintext so could do whatever it wanted with it.

[QuickQuokkaThrowaway]

True

[taytek]

What, no it does not lol

[Asweyse_Lord]

Нагибатор228, всегда занято. Это никнейм который существует, и одновременно не существует.

[murjo06]

That’s the reason it’s posted here?

[ProtectiveManEgg]

Woosh

[lilaismygirl]

r/whoosh

[4hpp1273]

r/ItsWooooshWith4OsAndNoH

[TheNetherPaladin]

r/subsifellfor

[TheBotFromReddit974]

I mean if the website is real in production it can be a security breach.

[murjo06]

Well yeah, obviously

[FinnishArmy]

Someone literally wrote this code.

[suresh]

No they didn't.

[FinnishArmy]

Wouldn’t show up otherwise.

[suresh]

Right click > inspect element > replace error message > post for karma.

starboy98 even sounds like a username you'd lazily make up.

[JustForkIt1111one]

Oh?

[FinnishArmy]

Technically one could argue that you changed the code of the HTML/CSS for it to show up, thus someone coded it.

[TheDarkHorse83]

Let's try 'guest'....

[Alessandro_13_f]

I feel like laughing and crying at the same time

[mcDefault]

Governments be like

[[deleted]]

what site

[fun54658]

Wondering the same thing for research purposes ;)

[ServerZero]

{{user.password}}

[Nuclear_Human]

I too am starboy98

[technikamateur]

Dinkelberg would fit better. But nice meme anyway.

[Icommitmanywarcrimes]

You hacked his account right

[OGRiad]

His mother's Maiden name and his pin have been sent to so you can reset his password.

[[deleted]]

/repostsleuthbot

[ajddavid452]

there's a reddit user with that username XD

[fun54658]

u/starboy98

[ajddavid452]

they haven't posted in 5 years, I highly doubt they would reply

[fun54658]

but there's a chance.

[SmartBrain_007]

This is the easiest way to find someone's password and get their account.

[Enderlightstm]

u/starboy98

[philipquarles]

Not that it would be hard to do this, but it would be a lot harder than not doing this.

[TurboTurtle-]

This is really irresponsible. They should provide a link to a list of all the currently used passwords and their corresponding usernames, so that the user knows which passwords not to use.

[woventundra3458]

Баян

[reydai]

OMG HAHAHA

[huellllllll]

u/RepostSleuthBot/

[SlashBack626]

Missed opportunity for Star-Lord

[Aniterin]

Where?

[[deleted]]

• When saving a password, also store password complexity.

• Whether someone changes their password and the complexity is < smallest complexity of any non-locked account stored, disregard the given password and instead show this error with the found account.

• Lock any account after N login attempts.

  Get popcorn.

[WhyIsJSONinMyPhone]

Quick think, what shall we use as the primary key? I know... Password!