Hacker News Reader

Comment by lossolo | Hacker News Reader

Clear text passwords? I thought it's 2016. If you are not using bcrypt/scrypt or similar in 2016 then you should change profession.

View on HN

The founder now runs secure messaging service with roll-your-own crypto.

Yep. Pavel Durov was forced out by various Kremlin connected folk for daring to stand up to the FSB and the Kremlin. He also went public about their unlawful requests. He then fled Russia.

edit: ugly sentence structure.

Just yesterday I clicked on the "Forgot Password" link on the AutoTrader.com website. I was expecting a reset link in my email and instead they just emailed me my password in cleartext. This is a huge website! Not some small business. It completely baffles me.

I wish that there was some way to shame these companies. I've seen some websites that list some of these offenders but they don't appear to be effective enough. I want news articles written about these companies in the magazines that the CIOs care about, with their photo right next to the article.

This seems to be the most popular collection: http://plaintextoffenders.com/

There should be a warning in the browser that these websites are known to store password in plaintext. This can be achieved by an extension too.

> This can be achieved by an extension too.

In the website you linked, there is a "3rd party tools" link [1] that has a Chrome extension [2] and a Firefox addon [3] that do just that.

[1]: http://plaintextoffenders.com/tools

[2]: https://chrome.google.com/webstore/detail/plain-text-offende...

[3]: https://addons.mozilla.org/en-US/firefox/addon/plain-text-of...

Yes, it's 2016, but they say that passwords were collected in 2011-2012/2013. Also, phrasing in Russian sources suggests that passwords were not dumped from DB, but actively collected by other means.

To get close to 50% of the user base? Sounds like a very very high success rate.

Or PBKDF2, which would be my preference in any stuffy corporate environment. Nobody ever got fired for following NIST/FIPS standards.

I'd use bcrypt if I were working on my own project though. I think scrypt goes too far, I would actually be concerned about its speed and memory utilization hurting responsiveness for any sort of web server or other latency-sensitive system.

You just dropped like 80% of the workforce

Reply on news.ycombinator.com