How does one accidentally set the failure mode of any piece of authentication code to escalate privileges instead of denying them? Even when I was first learning to code web apps I never found myself accidentally accepting any password.
It's shocking (to me, at least) because it seems like such a beginner mistake.
It's very doubtful something like Dropbox is as simple as
if(user.hashedPassword == sha1(salt + enteredPassword)) {
letUserIn();
} else {
error();
}
if(user.hashedPassword == sha1(salt + enteredPassword)) ; {
letUserIn();
}
Production
----------
@authenticate
def foobar():
....
-----------
#@authenticate ( Because developers are lazy, while testing)
def foobar():
....