News for hackers. Stuff that matters.
Re:Smart Enough Not To Build This Website by ajross on Thursday June 26, 2008 @11:03AM (#228667)
No, you're misunderstanding the threat model. The problem with plaintext passwords isn't the danger to you, it's the danger to your users. Users reuse passwords, they just do, and you can't stop them. Storing those passwords in plaintext means that when (yes, when) your site is compromised, the attacker (an employee, for example) can get a pre-validated list of emails and passwords that they can try on other sites.

I, personally, watched an ancient Western Union account of mine (no doubt created with a repeated password that I used for other services, like mailman lists, which store them in plaintext) used for fraud. Someone found another user with the same name, put their credit card on the account and stole $1000US.

Just don't do this. Just don't. Don't excuse it. Don't pretend you understand why you can get away with it. JUST DON'T DO IT.

There are no comments on this comment yet.