37
Shylor
8y

Customer: I keep getting your newsletter with my password in it.

Me: What?

I look through the accounts. The customer had set their name as their password... a year ago.

Comments
  • 0
    #SuperFail
  • 11
    And how do you know exactly, that username was in place of password? no hashing??
  • 1
    @tatocaster that was my question. My job here is done!
  • 0
    I expect the password was fairly odd and the user accidentally entered it into the user field as well. Potentially no password confirmation or something.
  • 1
    @tatocaster Maybe he hashed the name and the result was the same string as hashed password.
  • 1
    @tatocaster the customer put their password into the name field. So the newsletter said hello and then their password. Also I was the one that brought advanced password hashing into the company.
  • 1
    Also the newsletter system only allows name and email address. The password should have never been there.
  • 0
Add Comment