Microsoft Store India hacked

[MrMark]

Microsoft Store India database hacked | Ubergizmo

Apart from that, the database has also been exploited, and with all the passwords saved in plain text, the damage borders on the catastrophic compared to just a website being defaced.

Passwords saved in plain text.

[eek]

Microsoft Store India database hacked | Ubergizmo



Passwords saved in plain text.

Its a standard part "feature" of the membership provider .

[fullyautomatix]

Its a standard part "feature" of the membership provider .

Depends really on the which provider and what configuration of the provider. In aspnet sql membership provider for example, the configuration allows passwordFormat="[Clear|Hashed|Encrypted]". If the developers are foolish enough ( see my code snippets thread) to set the format to be clear text it is not the "feature" to be blamed.

[eek]

Depends really on the which provider and what configuration of the provider. In aspnet sql membership provider for example, the configuration allows passwordFormat="[Clear|Hashed|Encrypted]". If the developers are foolish enough ( see my code snippets thread) to set the format to be clear text it is not the "feature" to be blamed.

To be frank clear should not be an option and it definitely should not be the default option. Because it is an option people use it (including various "developers" in projects I've inherited) have used it and it leaves a mess that cannot sensibly be solved.