News for hackers. Stuff that matters.

A comment on Stop forcing arbitrary password rules. Parent comment

Re:Stop forcing arbitrary password rules by proactivesvcs on Saturday October 24, 2015 @08:25AM (#10443387)
You might be interesting in Plain Text Offenders' browser add-on. It warns when you're browsing a site that is known to store or send passwords in plain text: http://plaintextoffenders.com/
[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by 0x49 on Saturday October 24, 2015 @11:41AM (#10443901)
This site, while clever, is spreading potentially bad information. For instance, ive worked for plenty of companies that send out site-generated passwords. The password is stored encrypted and sent out once to the user. While not the most secure, an attacker still wont be able to get to all of the plaintext passwords if they cracked into the database.
[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by sfilipov on Saturday October 24, 2015 @12:47PM (#10444128)
If they can crack the database, what's preventing them from getting the key used to encrypt the database?
[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by 0x49 on Saturday October 24, 2015 @01:21PM (#10444223)
When i say encryption, i mean 1-way encryption like bcrypt. So they could get the hashes, but would still have to somehow brute-force it.
[ Parent | on HN ]