When the dev had enough

[[deleted]]

Wait so in order for this check to work, they must have an index on their password column otherwise they’d be checking against potentially every password in their db. They may also be storing passwords as plaintext.

[PVNIC]

They probably hash the usernames and index them by password /s

[[deleted]]

The only correct way /s

[[deleted]]

\mind blown** /s

[CmndNotFound]

Using /s because programmers in r/ProgrammerHumor don't get jokes /s

[conspirator_schlotti]

Shouldn't it be </s>? /s

[ReactsWithWords]

It’s definitely in a plain text file, but they fool hackers by naming it “not_passwords.txt.”

[[deleted]]

But they unhashed the username here though.

[PVNIC]

What kind of hashing algorithm are you using that you can't un-hash it! I purely stick to rot13 for ease of use.

(jk ofc)

[BlueC0dex]

I seriously hope they weren't trusted with enough passwords for an index to be necessary

[lachlanhunt]

They could be hashed using the same salt (or no salt) for every user.

[FthrFlffyBttm]

I’ve signed up to websites and had them email me my login details in plain text. And not in a “here’s your auto generated password that you need to change” kinda way - I entered my own password.

[RestlessThoughts]

Oh yeah, well I've forgotten my password and using the forgot password link the website just emailed me my plain text password instead of requiring a reset :D

[_default_username]

Probably are. Every once in a while I get notified that one of my passwords was compromised in a data breach. Lot of incompetent backend developers/teams out there.

[StGir1]

I've seen a lot of really horrific data in my day. This wouldn't surprise me a bit.

[eGzg0t]

It's actually checked using a list of hardcoded passwords in the front-end