WTAF?
you can add extra characters to your password and it's still accepted?
a) no, that's not how passwords are supposed to work
b) no, you're storing the passwords
(not just wrong, but you're storing them in the first place)
c) you're not hashing them?
d) YOU ARE A F**KING BANK!
@0x56 so at that bank, passwords are like phone numbers... once you get the first few right, it doesn't matter how many you punch in afterwards.. its already open.
@Bemet_Or - pretty much.
@0x56 hmmmm weird.
that shouldn't be how it works for PW's I agree.
Claire sounds like she's just following orders on what to say, cuz to me that is a flaw.
@Bemet_Or - oh she is, don't blame the messenger... But a password should _never_ be stored, it should be hashed (1 way encryption)
so "abc" would be hashed to something like
"ab98f80e7f3a9b"
but "abcd" would be hashed to something like
"9f02c756a37e1"
there's no correlation to compare partial passwords against.
The reason for this is if the database is compromised, there's no way of getting those passwords out.