• Cocodapuf@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    7 months ago

    It could matter if some specific credentials were initially acquired because some other place was storing clear text passwords, and that place had a breach.

    Exactly, that was my assumption.

    After all, reusing passwords for multiple sites becomes a problem as soon the password becomes known. But for that password to become known, some site had to either allow the plaintext password to be leaked, or an unsalted hash. Or the site has to allow for insecure (easily guessable) passwords to be used.

    Reusing passwords is undeniably the user’s fault, but only because some other site’s security measures may also have been negligent.