Well, that's true, in part, but since one would HOPE that any modern server would store their passwords in hashed format, not plaintext. The purpose of the hash, as you know, is to prevent it from being reversed back to it's plaintext. Thus, if they get breached, they get no passwords.
That's a good point -- if a server is hacked and the server properly stored password hashes, your password is not instantly known. However, with a list of password hashes, many passwords can be figured out.
Even if a hacked server wouldn't instantly expose your password -- let's remember that the hacked server, if not discovered immediately, could have new scripts run on it that would harvest passwords when you provide them to it.
Bottom line -- don't use the same password on different sites. Use a password manager tool to help you create a nice long unique password for each site.
Personally I think SSL use on everything is overkill -- I prefer a more pragmatic approach: Never provide financial information on a connection that is not SSL -- but on simple non-critical website logins, I don't give it a second thought. SSL is provided on DonationCoder using https (at non-trivial effort and expense I might add) as a courtesy to those who view it as important (even if I think it's overkill for most users).
[ps. i've removed the caps "WARNING" line from the subject of this thread since i think it would lead to confusion]
Recent Posts
