Interesting, sqli that works only for reading encrypted_hash from DB? But since ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

homakov on July 30, 2015 | parent | context | favorite | on: GitHub Raises $250M at $2B Valuation

Interesting, sqli that works only for reading encrypted_hash from DB? But since password is unique it cannot be bruteforced even locally.

bigiain on July 31, 2015 [–]

True - it's the (many many documented[1]) cases where the SQLi grabs the password_cleartext column, not the encrypted_hash one that worry me here.

[1] http://plaintextoffenders.com/

Consider applying for YC's Fall 2026 batch! Applications are open till July 27.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact