Ban me at the IP level if you don't like me

Re:Ban me at the IP level if you don't like me by rollcat on Monday August 25, 2025 @08:44AM (#45013232)

The way to handle a password:

    plaintextPassword = POST["password"]
    ok = bcryptCompare(hashedPassword, plaintextPassword)
    // (now throw away POST and plaintextPassword)
    if (ok) { ... }

Bonus points: on user lookup, when no user is found, fetch a dummy hashedPassword, compare, and ignore the result. This will partially mitigate username enumeration via timing attacks.

[ Parent | on HN ]

Re:Ban me at the IP level if you don't like me by Sophira on Monday August 25, 2025 @10:46AM (#45014452)

I believe you may have misinterpreted the comment. They're not talking about logs that were made from a login form on their website. They're talking about generic logs (sometimes not even web server logs) being generated because of bots that are attempting to find vulnerabilities on random pages. Pages that don't even exist or may not even be applicable on this server.

[ Parent | on HN ]