Re:Robinhood Stored Passwords in Plaintext
by gpm on Wednesday July 24, 2019 @09:49PM
(#20521930)
No, having a client side hashed password sit in your logs is way better because it only introduces risk for your own service, instead of risk for every user who reuses their password on multiple services. It changes a compromise log from a widespread identify theft risk to a contained privilege escalation risk.
(Provided either you, or all the other services using this scheme, are sensible enough to salt with a string unique to their website such as a domain name)
(Provided either you, or all the other services using this scheme, are sensible enough to salt with a string unique to their website such as a domain name)