Should I even use hash passwords in this situation?

Question

My site does not contain too sensitive data. I think about storing passwords, because if the user wanted to receive his password by e-mail (if he lost it), then I could send it to them, and not do something bulky and exhausting for users, such as sending them a new password was created (it is also ineffective).

Should I just keep them as is?

Answer 1

No, you have their hash. Most users have the same password on multiple sites, so even if your site is not too sensitive, there may be other sites with the same username and password that are more sensitive.

If users forget their passwords, send them a new one.

Answer 2

Why a dilemma? You probably shouldn't be designing an account management system yourself. Take some standard password management component and save yourself debugs and security errors.

Answer 3

: YES, HASH (AND SALT) PASSWORDS, .

, , , , - , .

Answer 4

- - , , - .

Answer 5

- , : . , , .

, , .

Answer 6

. , . , , , . , ( ), .

Answer 7

. , , , , .

Answer 8

openid (http://openid.net/) .

Answer 9

Definitely hash them; there is no reason not to. You can even encrypt the password in the user's browser and simply transfer the hash, for example. with the code used here .