@Cabrio@lemmy.world to Games@lemmy.worldEnglish • 2 years agoLarion Studios forum stores your passwords in unhashed plaintext.lemmy.worldimagemessage-square213fedilinkarrow-up1488file-text
arrow-up1488imageLarion Studios forum stores your passwords in unhashed plaintext.lemmy.world@Cabrio@lemmy.world to Games@lemmy.worldEnglish • 2 years agomessage-square213fedilinkfile-text
Larion Studios forum stores your passwords in unhashed plaintext. Don’t use a password there that you’ve used anywhere else.
minus-squaretb_linkfedilinkEnglish23•edit-22 years agoBut that still means they had your plaintext password at some point. Edit: which, as some replies suggest, may not actually be much of an issue. I’m still skeptical about them returning it, however.
minus-squarevoxellinkfedilinkEnglish16•edit-22 years agohashing on client side is considered a bad idea and almost never done. you actually send your password “in plain text” every time you sign up.
minus-square@wim@lemmy.sdf.orglinkfedilinkEnglish1•2 years agoIt’s not a bad idea and it is often done, just not in a browser/webapp context.
minus-square@hotdoge42@feddit.delinkfedilinkEnglish2•2 years agoCan you give an example where this is done?
minus-square@wim@lemmy.sdf.orglinkfedilinkEnglish3•edit-22 years agoSorry, I should have included an example in my comment to clarify, but I was in a rush. HMAC is a widely used technique relies on hashing of a shared secret for verifying authenticity and integrity of a message, for example.
minus-square@Kilamaos@lemmy.worldlinkfedilinkEnglish12•2 years agoOf course. You receive the password in plain on account creation, do the process you need, and then store it hashed. That’s fine and normal
minus-square@Vegasimov@reddthat.comlinkfedilinkEnglish13•2 years agoWhen you create an account you type your password in. This gets sent to the server, and then it is hashed and stored So there is a period of time where they have your unhashed password This is true of every website you have ever made a password on
minus-square@Vegasimov@reddthat.comlinkfedilinkEnglish1•2 years agoI’ve never even heard of the game studio I’m not defending them, I was replying to the person who said the company should never have your unhashed password, and explaining that they have to at some point in the process
minus-square@dangblingus@lemmy.worldlinkfedilinkEnglish2•2 years agoSo why would an agent at Larian have man-in-the-middle access between the password being sent to the server, and the auto-hash?
minus-square@Hexarei@programming.devlinkfedilinkEnglish4•2 years agoUm. Yeah, because you provided it to them. They have to have it in plain text in order to hash it.
But that still means they had your plaintext password at some point.
Edit: which, as some replies suggest, may not actually be much of an issue.
I’m still skeptical about them returning it, however.
hashing on client side is considered a bad idea and almost never done.
you actually send your password “in plain text” every time you sign up.
Really everytime you log in too.
It’s not a bad idea and it is often done, just not in a browser/webapp context.
Can you give an example where this is done?
Sorry, I should have included an example in my comment to clarify, but I was in a rush.
HMAC is a widely used technique relies on hashing of a shared secret for verifying authenticity and integrity of a message, for example.
deleted by creator
Of course. You receive the password in plain on account creation, do the process you need, and then store it hashed.
That’s fine and normal
deleted by creator
When you create an account you type your password in. This gets sent to the server, and then it is hashed and stored
So there is a period of time where they have your unhashed password
This is true of every website you have ever made a password on
deleted by creator
I’ve never even heard of the game studio I’m not defending them, I was replying to the person who said the company should never have your unhashed password, and explaining that they have to at some point in the process
So why would an agent at Larian have man-in-the-middle access between the password being sent to the server, and the auto-hash?
Um. Yeah, because you provided it to them. They have to have it in plain text in order to hash it.