Developer Pills

# re: Security Tip

Hi Adel,

Although I get your tip, I'm not quite sure I agree. Probably because you don't post why you should do this. ;)

I think the user is the one who, as soon as he/she chooses to change his/her password, is responsible for choosing a good password.

And by the way, my hotmail and Gmail passwords (for example) have been te same since I got an account...

# re: Security Tip

The idea is good, but it's not really safe to keep  the passwords itself in the backend. A much safer approach would be to hash it before it goes into the database. Then, at login you compare the hash of what the user entered with what's in the database.

If you want, you then keep a log of old password hashes to prevent an old pw from being chosen again.

Even better is to use a so-called 'salted hash'.

# re: Security Tip

@Rick van den Bosch

The reason you may wanted to do this..if your password base compromised you wanted to change the password for your clients to something tempporary and also prevent them from changing this back to the old compromized one, however you also will benfit from this stratigy to force users to never having the same password they already changed - why they change their password on the first place - to be using it again...

@Arjan Zuidhof

exactly how this should work.