Hacker News Reader

Comment by city41 | Hacker News Reader

Really awesome site, I hope it does well.

However, after signing up your welcome email contained my password in plain text. Which probably means you are storing it in plain text. Please consider doing a one way hash on it for better security.

View on HN

The password is probably encrypted, but reversibly so. That's still a potential security hole, but an attacker would need both the database (with its encrypted passwords) and the key.

Yes, that is correct. But we probably shouldn't email the password to the user. Just let them change it. Might consider a one-way hash instead of a two-way one though.

Minor nitpick: There's no such thing as a two-way hash.

And here is a tiny nitpick: I can log in with my email address even though the login form says "Username".

If both of them work that sounds like a great feature for most people.

But why require a username, then?

It does indeed seem a bit strange to require a username when an email-address is enough. However, my point was that even though they use usernames, they still allow you to simply login by using their e-mail address. That's a lot better than sites having a 'lost your username?' link IMHO.

We need the username in order to say who edited what.

How about using the email address instead (and offer a username as a display alias only, if people don't want to have their email address displayed).

Meh -- who would want their email address displayed? That's not a safe default. You'd just be punishing the users who don't manage to find the setting.

Reply on news.ycombinator.com