Initially Posted by bear
Asking for passwords, until it is particularly to troubleshoot your expertise that may’t be duplicated in another approach, is just not one thing I might be snug with. Just about all firms can be prepared to vary your password for you, however seeing the prevailing one is not seemingly. Sure, they might then log in utilizing it, however that is not a standard verification, I might say.
I do not actually agree right here. However, we’re all entitled to our opinions.
From my expertise customers can hardly ever keep in mind their very own passwords. So having them keep in mind one thing else to confirm account possession is simply asking for extra bother.
Initially Posted by bear
There are, in fact, exceptions. I as soon as requested an organization for my login data since I used to be having bother. They despatched me an Excel spreadsheet with ALL ACCOUNTS ON THE SERVER, together with passwords. So as to add to the hilarity, it was the improper server. They then despatched me the proper one.
I left that day.
This really results in two factors:
Passwords needs to be a one-way hash. To confirm a password you do not unmask the hash to see if it matches the textual content string given. You hash the textual content string and see if it matches the saved hash.
This additionally illustrates the significance of fixing your password anytime you give (or are given) the password to a service. Once we order new servers, the server supplier offers us the foundation password via some means. I instantly change that password. I do not replace the foundation password of their on-line account administration portal. If they need root entry to the server, they’ll ask me.
On this specific occasion had each account on the spreadsheet modified their password AND not informed the service supplier the brand new password, then that spreadsheet can be null and void. Granted, that is a excessive ask for each account to do – however it illustrates the safety advantages of fixing your password and never disclosing that data to the service supplier. Whereas I undoubtedly agree, I might go away the service too in the event that they pulled a stunt like that, I’d additionally take solace in realizing that had that listing been supplied to anybody else the login data pertaining to my accounts wouldn’t be legitimate.
(I suppose I am assuming this service was a server supplier. I suppose a service that is net based mostly, the place there’s just one interface to regulate the password data, you are actually on the mercy of that service supplier. While you change your NetFlix password, how have you learnt clicking that submit button does not save the brand new password in plaintext in a database some the place?)