3 added 226 characters in body
source | link

The whole "unique and random" serves a double purpose in this imperfect world, where websites cannot be trusted to either do the right thing nor have good intentions.

The website could sell the username password combos to crackers for research and incorporation into advanced dictionary attacks. Aka doing intentional harm. Provide a free game, require registration, see how many dummies use the same credentials as their facebook or google accounts.

Then of course there is just the dummies that don't know anything about security and store them in plaintext.

Either way its bad and you as a user should assume that the website is untrustworthy and use a unique and random password.

And if you are a developer making a silly internet game, consider that your users could very well not know good security practices and end up using the same credentials for your game as for their bank account, and if your internet game is hacked and the password table stolen, then you could have unintentionally done great harm to your customers.

So yes I say its always important to take security seriously whether you're a developer or a user. And if you take security seriously, then no its never ok to store passwords in plaintext, nor is it acceptable to not salt them, or other antiquated bad practices.

In your particular case, you would want to encrypt the passwords based on something that only the user of your software knows rather than hashing them, because it sounds like your application is something like a password manager. There are libraries out there that make it easy depending on the technology you're using. .NET?

The whole "unique and random" serves a double purpose in this imperfect world, where websites cannot be trusted to either do the right thing nor have good intentions.

The website could sell the username password combos to crackers for research and incorporation into advanced dictionary attacks. Aka doing intentional harm. Provide a free game, require registration, see how many dummies use the same credentials as their facebook or google accounts.

Then of course there is just the dummies that don't know anything about security and store them in plaintext.

Either way its bad and you as a user should assume that the website is untrustworthy and use a unique and random password.

And if you are a developer making a silly internet game, consider that your users could very well not know good security practices and end up using the same credentials for your game as for their bank account, and if your internet game is hacked and the password table stolen, then you could have unintentionally done great harm to your customers.

So yes I say its always important to take security seriously whether you're a developer or a user. And if you take security seriously, then no its never ok to store passwords in plaintext, nor is it acceptable to not salt them, or other antiquated bad practices.

The whole "unique and random" serves a double purpose in this imperfect world, where websites cannot be trusted to either do the right thing nor have good intentions.

The website could sell the username password combos to crackers for research and incorporation into advanced dictionary attacks. Aka doing intentional harm. Provide a free game, require registration, see how many dummies use the same credentials as their facebook or google accounts.

Then of course there is just the dummies that don't know anything about security and store them in plaintext.

Either way its bad and you as a user should assume that the website is untrustworthy and use a unique and random password.

And if you are a developer making a silly internet game, consider that your users could very well not know good security practices and end up using the same credentials for your game as for their bank account, and if your internet game is hacked and the password table stolen, then you could have unintentionally done great harm to your customers.

So yes I say its always important to take security seriously whether you're a developer or a user. And if you take security seriously, then no its never ok to store passwords in plaintext, nor is it acceptable to not salt them, or other antiquated bad practices.

In your particular case, you would want to encrypt the passwords based on something that only the user of your software knows rather than hashing them, because it sounds like your application is something like a password manager. There are libraries out there that make it easy depending on the technology you're using. .NET?

2 added 164 characters in body
source | link

The whole "unique and random" serves a double purpose in this imperfect world, where websites cannot be trusted to either do the right thing nor have good intentions.

The website could sell the username password combos to crackers for research and incorporation into advanced dictionary attacks. Aka doing intentional harm. Provide a free game, require registration, see how many dummies use the same credentials as their facebook or google accounts.

Then of course there is just the dummies that don't know anything about security and store them in plaintext.

Either way its bad and you as a user should assume that the website is untrustworthy and use a unique and random password.

And if you are a developer making a silly internet game, consider that your users could very well not know good security practices and end up using the same credentials for your game as for their bank account, and if your internet game is hacked and the password table stolen, then you could have unintentionally done great harm to your customers.

So yes I say its always important to take security seriously whether you're a developer or a user. And if you take security seriously, then no its never ok to store passwords in plaintext, nor is it acceptable to not salt them, or other antiquated bad practices.

The whole "unique and random" serves a double purpose in this imperfect world, where websites cannot be trusted to either do the right thing nor have good intentions.

The website could sell the username password combos to crackers for research and incorporation into advanced dictionary attacks. Aka doing intentional harm. Provide a free game, require registration, see how many dummies use the same credentials as their facebook or google accounts.

Then of course there is just the dummies that don't know anything about security and store them in plaintext.

Either way its bad and you as a user should assume that the website is untrustworthy and use a unique and random password.

And if you are a developer making a silly internet game, consider that your users could very well not know good security practices and end up using the same credentials for your game as for their bank account, and if your internet game is hacked and the password table stolen, then you could have unintentionally done great harm to your customers.

So yes I say its always important to take security seriously whether you're a developer or a user.

The whole "unique and random" serves a double purpose in this imperfect world, where websites cannot be trusted to either do the right thing nor have good intentions.

The website could sell the username password combos to crackers for research and incorporation into advanced dictionary attacks. Aka doing intentional harm. Provide a free game, require registration, see how many dummies use the same credentials as their facebook or google accounts.

Then of course there is just the dummies that don't know anything about security and store them in plaintext.

Either way its bad and you as a user should assume that the website is untrustworthy and use a unique and random password.

And if you are a developer making a silly internet game, consider that your users could very well not know good security practices and end up using the same credentials for your game as for their bank account, and if your internet game is hacked and the password table stolen, then you could have unintentionally done great harm to your customers.

So yes I say its always important to take security seriously whether you're a developer or a user. And if you take security seriously, then no its never ok to store passwords in plaintext, nor is it acceptable to not salt them, or other antiquated bad practices.

1
source | link

The whole "unique and random" serves a double purpose in this imperfect world, where websites cannot be trusted to either do the right thing nor have good intentions.

The website could sell the username password combos to crackers for research and incorporation into advanced dictionary attacks. Aka doing intentional harm. Provide a free game, require registration, see how many dummies use the same credentials as their facebook or google accounts.

Then of course there is just the dummies that don't know anything about security and store them in plaintext.

Either way its bad and you as a user should assume that the website is untrustworthy and use a unique and random password.

And if you are a developer making a silly internet game, consider that your users could very well not know good security practices and end up using the same credentials for your game as for their bank account, and if your internet game is hacked and the password table stolen, then you could have unintentionally done great harm to your customers.

So yes I say its always important to take security seriously whether you're a developer or a user.