Hacker News Reader

It's just infuriating, because credit card companies are the ones behind, for example, PCI. Which has guidance like:

"8.4 Render all passwords unreadable during transmission and storage on all system components using strong cryptography"

View on HN

This requirement is technically fulfilled by encrypting transmissions with TLS and storage with disk encryption like LUKS or Veracrypt. It does not really say anything about password hashing.

The screenshot shows that the plaintext password was sent over SMTP. So it isn't meeting that bar either.

What makes you think it's SMTP and not SMTPS?

Because you can't force the endpoints of your customers to all support that.

Reply on news.ycombinator.com