News for hackers. Stuff that matters.
Re:Database leak exposes 3.3M Hello Kitty fans by joshka on Tuesday December 22, 2015 @01:47PM (#10779496)
This is an interesting idea. I think you could take it a little further though.

How about databases explicitly disallow direct comparison or materialization of any field named 'Password', 'Passwd' etc. I'm aware that this would be a breaking change, and would require overrides to support legacy software. That said, the defaults would lead developers to a secure by default mindset. If n00b dev1 realizes that s/he can't store a password and get it back again, they go looking for why and find that the only way is to call something like:

  SELECT IsPasswordValid(Password, @Password) FROM Users
  UPDATE Users
  SET Password = StorePassword(@Password)
Edit: I realize that there are security issues with the suggested sql. A PAKE is probably necessary.

There are no comments on this comment yet.