Timeline for Is this scenario an exception to the rule of never storing passwords in plaintext?
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 6, 2020 at 22:31 | comment | added | Michael Shaw | “It needs to fill the requirement” is the crux of our different views. I’d flag up that requirement as in need of refactoring - and I would not force weak security on students who have no choice in the matter - even if that means I’m seen as a blocker or not a team player for a while with the professor. He is wrong, he’s creating extra work, as doing it properly is out of the box functionality with current web frameworks. There is no justification for doing a poor job here. | |
| Jan 6, 2020 at 17:37 | comment | added | J.Hirsch | @MichaelShaw I would agree normally; however the difference is no one but the professor is logging into the laptop (normally), and it needs to fulfill the requirement. If it's not on the server the 'baddies' aren't getting to it easily. After all we're already pretty far out in the 'that's nuts' side, so if you wanted to be really careful you could print it out and lock it up in a safe... that's what we do with crypto :_) | |
| Jan 5, 2020 at 20:12 | comment | added | Michael Shaw | But @J.Hirsch you would still have a spreadsheet of all usernames and passwords in clear text stored on the professors laptop, with no explicit monitoring around to ensure it has not been compromised - a huge security risk. This file should not exist - Anywhere. | |
| Jan 5, 2020 at 19:54 | comment | added | J.Hirsch | I do like this. I would actually go one step further, however, to comply with the request to have user/passwords. I don't understand why the passwords have to be stored in an accessible method. A spreadsheet of username/password, with generated hashes, and then said generated hashes stored on the server/resource, is all that is needed. The professor gets his 'lookup' table, you get to do best-practice security, and never the two shall meet. | |
| Jan 4, 2020 at 8:30 | comment | added | Matt Ellen | There is no need to store any identifying information. The student asks for the password for their username. I realise this isn't secure, but since users have to request their passwords from the Prof anyway, no need to store any personally identifiable information on the server. | |
| Jan 3, 2020 at 8:10 | comment | added | Michael Shaw | Yep, good call, I meant they didn’t need a username, they just have an access code. | |
| Jan 3, 2020 at 8:09 | history | edited | Michael Shaw | CC BY-SA 4.0 |
edited body
|
| Jan 3, 2020 at 6:20 | comment | added | Laiv |
just give each student a secret access code. are not passwords that sort of code?
|
|
| Jan 3, 2020 at 4:34 | history | answered | Michael Shaw | CC BY-SA 4.0 |