I don't think what Reddit did was that bad either. The odds were that they'd fail and no one would have cared that they had plain text passwords. I think startups generally have much better programmers, but their work is so geared towards speed that security comes second. That probably just means the level of security vs IBM is a draw.
BTW. MySpace seems to still store plain text passwords. Try the "forgot my password" feature.
No; my whole point was that, that's right, we don't know who's making more stupid mistakes, one way or the other.
"I think startups generally have much better programmers, but their work is so geared towards speed that security comes second. That probably just means the level of security vs IBM is a draw."
That's exactly why I disagreed with PG, because it's probably a draw.
IMNSHO they made the wrong choice, and I think they'd agree now. But it wasn't because they were stupid or ignorant. They made a judgment call, and it turned out their users disagreed. It's not easy servicing a consumer website with hundreds of thousands of users: no matter what you do, somebody will be pissed off.
Besides, at least they weren't like GreatestJournal.com, which not only stored their passwords in cleartext and used an open-source (LiveJournal) codebase, but left their database server exposed to the Internet. My friend did a simple "SELECT username, password FROM user" and ended up with 65K passwords.
My post was clear-as-daylight a counter-example to Paul's statement, not an attack on Reddit.
You can even see my second sentence said, "there are likely smart guys working for IBM, _as well_." But, now people are going to think I hate Reddit or YCombinator because I disagreed with PG...
If they had, it probably wouldn't have bothered people much.
It's trivial to find out though, for any website - do a "Forgot password" retrieval, and if they send you the password itself, it's stored in cleartext. If they send you a link to reset it, it's hashed.
IIRC, Reddit, MySpace, all LiveJournal clones, and IMDB all store in plaintext. Drupal installations hash them.
Most of us hackers are jack of all trades, focusing on web design, databases, business logic, and security. It is difficult to be an expert in all areas while simultaneously focusing on speed of release. Just because a company has security experts doesn't guarantee secure software (Microsoft), but in many cases it does help.