News for hackers. Stuff that matters.

A comment on Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years. Parent comment

Re:Facebook Stored Hundreds of Millions of User Passwords in... by javagram on Thursday March 21, 2019 @01:02PM (#19454629)
That’s hardly a best practice and if followed consistently just means that the hash is your actual password, which means if someone steals the hash from a log file they can still impersonate you.

Unless you actually mean some sort of challenge response scheme which is rather uncommon to see, e.g. http “digest” authentication or SRP.

[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by qpiox on Thursday March 21, 2019 @01:26PM (#19454927)
The big problem of a service having your true password (instead of the hash of the password) is that many users use the same password for a multitude of services (read Gmail, Hotmail, Yahoo, Amazon, ...)

So it's bad practice to keep or transfer the users cleartext password. It should never leave her browser/client. Period.

[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by aeorgnoieang on Thursday March 21, 2019 @02:42PM (#19455881)
If the service has only the hash of the password, then that's the password, which would then be subject to the same problems as a "cleartext password".
[ Parent | on HN ]
Re:Facebook Stored Hundreds of Millions of User Passwords in... by javagram on Thursday March 21, 2019 @01:50PM (#19455228)
Password managers and service specific 2FA solve that problem quite nicely for now (edit: although yes most users aren’t willing to do that).
[ Parent | on HN ]