I recently found out that a website I use every day let me know my hashed password.
The process was the following :
- Go to "Delete account" and enter your password. Password is checked.
- If password is correct, a form then appear where you have to set why you are deleting your account (at this moment, the account is not yet deleted). There is an hidden input called
hashedPasswordcontaining what I think is my hashed password.
- When you valid the form, your account is deleted.
Since you first have to input your password to get the hashed password, I don't directly consider it a vulnerability. This process doesn't look dangerous to me, even if I was a little bit surprise to see my hashed password.
All I can see is that it might allows the user to discover the hashing algorithm, or even let you find the salt used.
Is this a bad practice ? Is it dangerous and how could it be used by an attacker usefully ?