News for hackers. Stuff that matters.

A comment on The Correct Way to Validate Email Addresses. Parent comment

Re:The Correct Way to Validate Email Addresses by menssen on Wednesday September 07, 2016 @11:52PM (#12450193)
An extremely large company I was involved in building a system for had a requirement that you be able to read your password over the phone to a call center agent, resulting in requirements like case insensitivity and character limits.

Terrible security, sure, but at least it came from the desire for usability, not just basic encryption idiocy.

[ Parent | on HN ]
Re:The Correct Way to Validate Email Addresses by mjevans on Wednesday September 07, 2016 @11:56PM (#12450206)
No, the system isn't secure.

The text of the password should not persist.

[ Parent | on HN ]
Re:The Correct Way to Validate Email Addresses by f0urtyfive on Wednesday September 07, 2016 @11:59PM (#12450220)
Who said the text persists, you could take it off the phone and type it in to compare against any existing salted hash. Still not good security, but not necessarily stored in plaintext.
[ Parent | on HN ]
Re:The Correct Way to Validate Email Addresses by menssen on Thursday September 08, 2016 @12:04AM (#12450241)
(For the record, yes this is how it worked.)
[ Parent | on HN ]