Hacker News Reader

NEVER EVER send a password as clear text.

EVER.

If that was a requirement, then the submitter should have said something.

Just curious, how would you go about not sending out the password in cleartext? I understand WHY but I've never really figured out how to avoid doing so*

*yeah, I realize I'm asking for trouble with this :)

POST it to an HTTPS endpoint.

How do we know the code isn't already posting to an HTTPS url?

We don't. I'm simply answering the asked question - how does one securely transmit the user's password to a web application.

Reply on news.ycombinator.com