"intext:username AND intext:password"
The phrase is a Google search operator used in Google Dorking (advanced hacking/search techniques).
There are several uses of intext username and password:
Real-World Examples of Findings Using intext:username and password
- In-Text (Transmission): The focus of this post. The data is exposed while moving from point A to point B. Even if the server is secure, the journey is not.
- In-Database (Storage): This refers to how the server saves the password. Best practice dictates passwords should be hashed and salted (scrambled) in the database. However, even if a database hashes passwords perfectly, it is useless if the user sends the password in clear text to the server first—hackers can intercept it before the server ever hashes it.
A strong password is: At least 12 characters long but 14 or more is better. A combination of uppercase letters, lowercase letters, Microsoft Support