Re:Robinhood Stored Passwords in Plaintext
by naniwaduni on Wednesday July 24, 2019 @08:11PM
(#20521445)
This is still a meaningful improvement because accidentally making everything world-readable is in many cases easier than accidentally making everything world-writable.
It’s not assuming that has happened, it’s acknowledging it could happen (or any other bug that reveals database field, e.g. sql injection). It seems like it should just be a default practice - generally I try to design systems to fail safe, regardless of what causes that failure.
To be clear, it would have prevented these logged passwords from impacting other websites if the true cause of the Robin Hood password reset was a logging issue.
As a user, you can prevent this from happening either way by choosing strong, unique passwords for every service.