Hacker News new | past | comments | ask | show | jobs | submit login

> (UPDATE users SET password=null WHERE hashing_scheme='old')

Except you did this while the world was on fire, late on a Friday night, after a few beers, with management screaming down the phone. And you didn't check to make sure it didn't allow anyone to log into all effected users accounts with a null/empty password. Oooops...

(Been there, done that, made similarly stupid mistakes...)




An empty string hash does not equal the empty string (if you are on Oracle) and does certainly not equal null.

This will make it impossible for those users to login. Also, if you are luck it won't take the rest of the service down with them, making it impossible for the other users to login too.


Biologist here; so would the proper approach be

UPDATE users SET password=[generateRandomString] WHERE hashing_scheme='old';

?


No, same query but you need to make sure your authentication system disallows logging into accounts with null / empty passwords.


Wow, ouch.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: