"current password"

Vibhakar Solanki [gala]
8 years ago | edited 8 years ago

0

I was just changing my password
and i saw

HT asks for New pass and repeat pass

Now some of u mignt think yeah,so what ???

well what if someone gets hold of your pass

he can then change the pass easily [though he will be a as*hole if he does that]

thats why i think that HT should have Three fields

[list]
[] current password
[]new password
[*]repeat password
[/list]

4replies

4voices

206views

1image

tehron
8 years ago

2

If someone has your password, he won’t dare to enter it as “current password”, right?

dimooz
8 years ago

0

Maybe HT should disconnect users when inactivity > 15 mn (in example), by the way you could almost be sure that nobody will use your profile (to change your pass) if you forgot to logout by yourself..?

f0rk [HackingGuy]
8 years ago | edited 8 years ago

0

I think @gala was alluding to some form of bypassing authentication, rather than stealing credentials, such as cookie injection. But to be fair, just adding a ‘current password’ parameter would only aid security in a scenario of auth bypass, which is highly unlikely. We should develop a comprehensive system ( such as multi-factor auth? ) to change a password.

There’s no place like 127.0.0.1

Vibhakar Solanki [gala]
8 years ago

0

well said HackingGuy

Discussion thread has been locked. You can no longer add new posts.