That's all fine until there's a bug or attack and now your server generated pass... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		sofixa on May 4, 2022 \| parent \| context \| favorite \| on: Heroku resetting passwords for “a portion” of thei... That's all fine until there's a bug or attack and now your server generated password is logged somewhere.

8organicbits on May 4, 2022 [–]

Agreed, you don't want to log passwords. But that's not unique to server generated passwords, you also need to avoid logging user generated passwords as well.

I'd recommend storing server generated passwords in the same way a user generated password should be stored on the backend: bcrypt or scrypt.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact