undefined | Better HN

0 pointsredblacktree10y ago0 comments

> maximum length

This one really grinds my gears because it also indicates that they're most likely storing your password in the clear. Hashes are all the same length.

0 comments

3 comments · 1 top-level

msellout10y ago· 2 in thread

Or worse, if they ask you to type your password into a phone keypad (eg. the 9 button stands in for [9w-zW-Z] and 0 for all punctuation). Not only does this mean they're storing your password in plaintext, but reducing the character set to just 0-9.

A major financial company does this, of all the terrible places.

kragen10y ago

It doesn't imply they're storing your password in plaintext, no.

mikeash10y ago

It doesn't guarantee it, but it does imply it pretty heavily.

The alternative is that they're smart enough to come up with a clever scheme like hashing your password in both its raw form and when converted to 0-9, but not smart enough to realize how converting your password to 0-9 makes it vastly less secure.

1 more reply

j / k navigate · click thread line to collapse