Is an 'if password == XXXXXXX' enough for minimum security?
- by Morgan Herlocker
If I create a login for an app that has middle to low security risk (in other words, its not a banking app or anything), is it acceptable for me to verify a password entered by the user by just saying something like:
if(enteredPassword == verifiedPassword)
SendToRestrictedArea();
else
DisplayPasswordUnknownMessage();
It seems to easy to be effective, but I certainly would not mind if that was all that was required. Is a simple check on username/password combo enough?
Update: The particular project happens to be a web service, the verification is entirely server side, and it is not open-source. Does the domain change how you would deal with this?
