- cross-posted to:
- [email protected]
- cross-posted to:
- [email protected]
cross-posted from: https://lemmy.world/post/53941877
You must log in or register to comment.
“we just had a breach and soft forcing users to change their credentials”
It legit pisses me off when a site has the gall to claim I forgot my password. My password manager did not forget!!
IT devs who wrote oldpassword===newpassword checks should be tarred feathered hung drawn and quartered, in that order.
Yeah! They should be checking a list of old hashes, so that none of the previous passwords can be used!
Nah, use a password manager and stop using that garbage collection of characters you’ve used for over a decade.
Password managers don’t protect against passwords being stored in plaintext on the server side… Which my main comment implies.
If I had to implement a same password check, I would simply check if the new password works to authenticate the user. If it doesn’t, then it’s different. There’s no reason or excuse to ever store plaintext passwords.
They should also fire the ones who make it so the correct password fails when you enter it.
(enters “4”)
Notification: Your password has changed
