Hacker News Reader

Its ridiculous that so many sites do this. Especially since it takes all of 2 seconds to activate a salting + hashing function in current web frameworks of today...and if you're not on a framework, it takes all of 30 seconds to write your own salting + hashing function or find one on the internet...

View on HN

You know, I wrote at least fifteen web CMS-sites, as a teenager, before I ever learned the definitions of the words "hash function" and "salt." I saw them used, but I had no idea what they were for, so I just did what I understood how to do: stored passwords in plaintext. Of course, to do this professionally is inexcusable—but how many "professionals" do you think are on the same knowledge level I stood at when writing those websites?

Yeah - it totally sounds ridiculous, which is why I don't buy it. Something fishy is going on >:)

Its not all that ridiculous. A company that I used to work for did this. And while anecdote != data, I've seen it happen often enough to realize that a lot of devs just dont care about security.

Reply on news.ycombinator.com