Hacker News new | ask | show | jobs
by ollifi 1360 days ago
I sort of wish companies would not have employees passwords. Hashing should be standard practice.
2 comments

It must be, but publishing old passwords can still be done by saving the old cleartext password on password change.
As in store "old password" as cleartext on its final use?
Yes, that was my initial thought on how to make this possible. In my case, the company where I contract has a dedicated application (on Mac, at least) for password changes: record the old password and share it once the new password has taken effect.
The last password, to be posted, could be stored in plain text on the password change form submit action. Before that it is only ever committed to permanent storage as a hash.