Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>Or worse, they truncate your password after you've already used it for years and years.

Worse than that must be the sudden realization that your bank probably saves your password in plain text somewhere.



As it's a bank that's probably the case, but you could have a change on the server side from

  hash($password) == $storedhash
to

  hash(substr($password,0,20)) == $storedhash
And you wouldn't get in, with any password (including just putting in the first 20 characters)


More likely they just updated the password during a successful login.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: