How on earth can you both not accept the password I copied from my password safe and tell me that I cannot use the same pasaword again?

  • MajorHavoc
    2·
    6 hours ago

    How? If you can truncate user passwords, you should never handle user passwords again, unless you’re a student or hobbyist learning a valuable lesson.

    Yeah. The real reason to be alarmed is worse than the obvious one.

    If a partial version of what was originally set actually works later, it implies a scary chance they’re not even hashing the password before storing it.

    • sloppy_diffuser@sh.itjust.worksEnglish
      2·
      5 hours ago

      Also suggests the user may be reusing the same prefix if only the changed bits are getting truncated.

      Should use different random passwords every time. Completely random or a random string of words. While it doesn’t solve the cleartext password storage issue, a data breach won’t compromise all your other accounts to same degree.

      Doesn’t hurt to also randomize usernames, emails, and even security question answers.

      edit: or my new favorite passkeys, just make sure you trust whatever tool is managing your private keys.