News for hackers. Stuff that matters.

A comment on Password expiration is dead, long live passwords. Parent comment

Re:Password expiration is dead, long live passwords by setzer22 on Monday June 03, 2019 @02:14AM (#20080793)
> my old password was no longer permitted.

But how did they know? They should just have the hash...

[ Parent | on HN ]
Re:Password expiration is dead, long live passwords by eicnix on Monday June 03, 2019 @02:20AM (#20080816)
If they implemented it properly they could have checked the current password against the revised guidelines on the next login. No need to store it in plain text
[ Parent | on HN ]
Re:Password expiration is dead, long live passwords by uberswe on Monday June 03, 2019 @02:21AM (#20080822)
The website can check the password during login without storing it in plaintext
[ Parent | on HN ]
Re:Password expiration is dead, long live passwords by systemfreund on Monday June 03, 2019 @02:25AM (#20080839)
The login form usually sends the password in cleartext and it's then hashed on the server-side prior to comparing it to the hash stored in the database.

So they can just determine the password's strength at the time when the user is logging in

[ Parent | on HN ]