security - Possible to send password in plain text with SHA-256? -
i registered on site had specify sensitive information, eg. card number. got confirmation mail password in plain text. learned password should never in plain text. if can, means sensitive information stored in plain text too.
i contacted support , claim using encryption method sha-256 passwords. safe? still possible send plain text password after encryption?
is still possible send plain text password after encryption?
[rather ‘encryption’, reversible, mean ‘hashing’, assuming use of term “sha-256” correct. sha-256 one-way hash, whole point of it's not directly recoverable.]
no, conceivably have sent mail directly after entered password, rather storing , retrieving it.
in case plain sha-256 salted hash, considered unconscionably weak way store password today; hope deliberately slow password-hashing algorithm such bcrypt.
is safe?
no! sent password on public unprotected e-mail infrastructure! is, if anything, worse sin storing plaintext passwords in database...
Comments
Post a Comment