News for hackers. Stuff that matters.

A comment on Discover.com stores passwords in clear text.

Re:Discover.com stores passwords in clear text by aasarava on Thursday July 14, 2011 @12:52PM (#2763817)
I don't know about Discover.com, but Discovercard.com (for credit card account access) seems to cap passwords at 8 characters, which drives me crazy. Other than someone setting a database column to 8 chars and not wanting to deal with altering the table, what good can come of limiting password size to 8 chars?
[ Parent | on HN ]
Re:Discover.com stores passwords in clear text by feydr on Thursday July 14, 2011 @01:09PM (#2763890)
ahh -- my bad discover.com redirects to discovercard.com.

also, I just double-checked -- I have a mix of upper and lowercase in my password -- I downcased it and submitted -- and got in -- can someone explain that? I mean you have to pretty much goto lengths to do that... it's insane

[ Parent | on HN ]
Re:Discover.com stores passwords in clear text by pavel_lishin on Thursday July 14, 2011 @01:30PM (#2764001)
If they're storing it in plaintext, with a mysql backend - mysql doesn't care about case, by default. (At least, in my experience, this might have changed.)
[ Parent | on HN ]