Hacker News Reader

No, It does not mean that the password is stored as plaintext. Simply keep a flag for "UpdatedRecently?", if the flag is false, then not only should the first half of the input correctly match the hash, but the first half the input should match the second half.

View on HN

How is that helpful for mitigating security issues though?

Unless you are being specifically targeted (ie. the attacker knows that you have to repeat the password twice), you mitigate the easiest possible attack: user/password combination from a stolen database.

Although I suppose this was done to force the users to change their password.

Because it annoys the holdout users into changing their passwords.

Back in my day (old man grumble) the system would force you to change your password on next login. Simple, effective.

This approach is just a dumb prank.

I dislike being forced to change password without notice, I need some time to come up with a secure, typeable one. Change on next login just results in me reusing an old password or adding a "2" to the current one.

Do you consider this likely?

I'd probably flip a coin.

Reply on news.ycombinator.com